linux-kernel - [PATCH 1/2] cgroup-v1: Fix missing mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250718115409.878122-1-kerayhuang@tencent.com>
Date: Fri, 18 Jul 2025 19:54:08 +0800
From: Zijiang Huang <huangzjsmile@...il.com>
To: tj@...nel.org,
	hannes@...xchg.org,
	mkoutny@...e.com
Cc: cgroups@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Zijiang Huang <kerayhuang@...cent.com>,
	Hao Peng <flyingpeng@...cent.com>
Subject: [PATCH 1/2] cgroup-v1: Fix missing mutex_unlock in error paths

In the function, after acquiring the mutex with mutex_lock, multiple return
paths (such as returning ERR_PTR, NULL, or normal pointers)fail to call
mutex_unlock to release the lock, which could lead to deadlock risks.

Signed-off-by: Zijiang Huang <kerayhuang@...cent.com>
Reviewed-by: Hao Peng <flyingpeng@...cent.com>
---
 kernel/cgroup/cgroup-v1.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index fa24c032ed6f..73e0fd93111a 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -423,8 +423,10 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 	 */
 	if (!ctx->procs1.pidlist) {
 		ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist);
-		if (ret)
+		if (ret) {
+			mutex_unlock(&cgrp->pidlist_mutex);
 			return ERR_PTR(ret);
+		}
 	}
 	l = ctx->procs1.pidlist;
 
@@ -443,11 +445,14 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos)
 		}
 	}
 	/* If we're off the end of the array, we're done */
-	if (index >= l->length)
+	if (index >= l->length) {
+		mutex_unlock(&cgrp->pidlist_mutex);
 		return NULL;
+	}
 	/* Update the abstract position to be the actual pid that we found */
 	iter = l->list + index;
 	*pos = *iter;
+	mutex_unlock(&cgrp->pidlist_mutex);
 	return iter;
 }
 
-- 
2.43.5