linux-kernel - Re: [PATCH] cgroup/cpuset: update parent subparts cpumask while holding css refcnt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 1 Jul 2023 19:38:57 -0400
From:   Waiman Long <longman@...hat.com>
To:     Miaohe Lin <linmiaohe@...wei.com>, tj@...nel.org,
        hannes@...xchg.org, lizefan.x@...edance.com
Cc:     cgroups@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] cgroup/cpuset: update parent subparts cpumask while
 holding css refcnt

On 7/1/23 02:50, Miaohe Lin wrote:
> update_parent_subparts_cpumask() is called outside RCU read-side critical
> section without holding extra css refcnt of cp. In theroy, cp could be
> freed at any time. Holding extra css refcnt to ensure cp is valid while
> updating parent subparts cpumask.
>
> Fixes: d7c8142d5a55 ("cgroup/cpuset: Make partition invalid if cpumask change violates exclusivity rule")
> Signed-off-by: Miaohe Lin <linmiaohe@...wei.com>
> ---
>   kernel/cgroup/cpuset.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 58e6f18f01c1..632a9986d5de 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -1806,9 +1806,12 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
>   		cpuset_for_each_child(cp, css, parent)
>   			if (is_partition_valid(cp) &&
>   			    cpumask_intersects(trialcs->cpus_allowed, cp->cpus_allowed)) {
> +				if (!css_tryget_online(&cp->css))
> +					continue;
>   				rcu_read_unlock();
>   				update_parent_subparts_cpumask(cp, partcmd_invalidate, NULL, &tmp);
>   				rcu_read_lock();
> +				css_put(&cp->css);
>   			}
>   		rcu_read_unlock();
>   		retval = 0;

Thanks for finding that. It looks good to me.

Reviewed-by: Waiman Long <longman@...hat.com>