linux-kernel - Re: [PATCH v5] watchdog/hardlockup: Fix UAF in perf event cleanup due to migration race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aYIj7BzCI46iz2wj@pathway.suse.cz>
Date: Tue, 3 Feb 2026 17:35:56 +0100
From: Petr Mladek <pmladek@...e.com>
To: Qiliang Yuan <realwujing@...il.com>
Cc: Ingo Molnar <mingo@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Li Huafei <lihuafei1@...wei.com>,
	Thorsten Blum <thorsten.blum@...ux.dev>,
	Jinchao Wang <wangjinchao600@...il.com>,
	Yicong Yang <yangyicong@...ilicon.com>,
	Pingfan Liu <kernelfans@...il.com>,
	Lecopzer Chen <lecopzer.chen@...iatek.com>,
	Douglas Anderson <dianders@...omium.org>,
	linux-watchdog@...r.kernel.org, mm-commits@...r.kernel.org,
	Shouxin Sun <sunshx@...natelecom.cn>,
	Junnan Zhang <zhangjn11@...natelecom.cn>,
	Qiliang Yuan <yuanql9@...natelecom.cn>, Song Liu <song@...nel.org>,
	stable@...r.kernel.org,
	"Yury Norov (NVIDIA)" <yury.norov@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5] watchdog/hardlockup: Fix UAF in perf event cleanup
 due to migration race

On Mon 2026-01-26 21:22:24, Qiliang Yuan wrote:
> The hardlockup detector's probe path (watchdog_hardlockup_probe()) can
> be executed in a non-pinned context, such as during the asynchronous
> retry mechanism (lockup_detector_delay_init) which runs in a standard
> unbound workqueue.

[...]

> Refactor hardlockup_detector_event_create() to be stateless by returning
> the created perf_event pointer instead of directly modifying the per-cpu
> 'watchdog_ev' variable. This allows the probe logic to safely manage
> the temporary event. Use cpu_hotplug_disable() during the probe to ensure
> the target CPU remains valid throughout the check.
> 
> Fixes: 930d8f8dbab9 ("watchdog/perf: adapt the watchdog_perf interface for async model")
> Signed-off-by: Shouxin Sun <sunshx@...natelecom.cn>
> Signed-off-by: Junnan Zhang <zhangjn11@...natelecom.cn>
> Signed-off-by: Qiliang Yuan <realwujing@...il.com>
> Signed-off-by: Qiliang Yuan <yuanql9@...natelecom.cn>
> Cc: Song Liu <song@...nel.org>
> Cc: Douglas Anderson <dianders@...omium.org>
> Cc: Jinchao Wang <wangjinchao600@...il.com>
> Cc: <stable@...r.kernel.org>

Please, do not remove people from Cc, especially when you send new
versions on such a rapid speed.

I was on Cc only for this version. There were no replies. I started
review just to realize that another 4 versions were sent within
a week and they got some proper review and v9 already ended in
linux-next...

Best Regards,
Petr