[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230706081651.GF2833176@hirez.programming.kicks-ass.net>
Date: Thu, 6 Jul 2023 10:16:51 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Suren Baghdasaryan <surenb@...gle.com>
Cc: gregkh@...uxfoundation.org, tj@...nel.org, lujialin4@...wei.com,
lizefan.x@...edance.com, hannes@...xchg.org, mingo@...hat.com,
ebiggers@...nel.org, oleg@...hat.com, akpm@...ux-foundation.org,
viro@...iv.linux.org.uk, brauner@...nel.org, juri.lelli@...hat.com,
vincent.guittot@...aro.org, dietmar.eggemann@....com,
rostedt@...dmis.org, bsegall@...gle.com, mgorman@...e.de,
bristot@...hat.com, vschneid@...hat.com,
linux-kernel@...r.kernel.org, cgroups@...r.kernel.org,
linux-fsdevel@...r.kernel.org, kernel-team@...roid.com
Subject: Re: [PATCH v2 1/1] sched/psi: use kernfs polling functions for PSI
trigger polling
On Thu, Jun 29, 2023 at 05:56:12PM -0700, Suren Baghdasaryan wrote:
> Destroying psi trigger in cgroup_file_release causes UAF issues when
> a cgroup is removed from under a polling process. This is happening
> because cgroup removal causes a call to cgroup_file_release while the
> actual file is still alive. Destroying the trigger at this point would
> also destroy its waitqueue head and if there is still a polling process
> on that file accessing the waitqueue, it will step on the freed pointer:
>
> do_select
> vfs_poll
> do_rmdir
> cgroup_rmdir
> kernfs_drain_open_files
> cgroup_file_release
> cgroup_pressure_release
> psi_trigger_destroy
> wake_up_pollfree(&t->event_wait)
> // vfs_poll is unblocked
> synchronize_rcu
> kfree(t)
> poll_freewait -> UAF access to the trigger's waitqueue head
>
> Patch [1] fixed this issue for epoll() case using wake_up_pollfree(),
> however the same issue exists for synchronous poll() case.
> The root cause of this issue is that the lifecycles of the psi trigger's
> waitqueue and of the file associated with the trigger are different. Fix
> this by using kernfs_generic_poll function when polling on cgroup-specific
> psi triggers. It internally uses kernfs_open_node->poll waitqueue head
> with its lifecycle tied to the file's lifecycle. This also renders the
> fix in [1] obsolete, so revert it.
>
> [1] commit c2dbe32d5db5 ("sched/psi: Fix use-after-free in ep_remove_wait_queue()")
>
> Fixes: 0e94682b73bf ("psi: introduce psi monitor")
> Reported-by: Lu Jialin <lujialin4@...wei.com>
> Closes: https://lore.kernel.org/all/20230613062306.101831-1-lujialin4@huawei.com/
> Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>
Thanks, I'll stuff it in sched/urgent after -rc1.
Powered by blists - more mailing lists