linux-kernel - [PATCH v2 0/2] kernfs: Fix UAF in PSI polling when open file is released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250822070715.1565236-1-chenridong@huaweicloud.com>
Date: Fri, 22 Aug 2025 07:07:13 +0000
From: Chen Ridong <chenridong@...weicloud.com>
To: gregkh@...uxfoundation.org,
	tj@...nel.org,
	hannes@...xchg.org,
	mkoutny@...e.com,
	peterz@...radead.org,
	zhouchengming@...edance.com
Cc: linux-kernel@...r.kernel.org,
	cgroups@...r.kernel.org,
	lujialin4@...wei.com,
	chenridong@...wei.com,
	libaokun1@...wei.com
Subject: [PATCH v2 0/2] kernfs: Fix UAF in PSI polling when open file is released

From: Chen Ridong <chenridong@...wei.com>

This series fixes a use-after-free issue triggered when disabling and
enabling cgroup PSI.

---
v2:
 - Add kernfs_get_active_of() to safely acquire active references for
   kernfs open files suggested by Tj.
 - Split into two patches as suggested by Greg.

Chen Ridong (2):
  kernfs: Fix UAF in polling when open file is released
  cgroup/psi: Set of->priv to NULL upon file release

 fs/kernfs/file.c       | 58 +++++++++++++++++++++++++++---------------
 kernel/cgroup/cgroup.c |  1 +
 2 files changed, 39 insertions(+), 20 deletions(-)

-- 
2.34.1