From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAA1943F08A for ; Fri, 17 Jul 2026 21:01:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784322108; cv=none; b=ODR66Gw1Ka8yPZ37cfrLBdAULnEYS60hEQycKkcHw8TKv2znbpsqH+btxEFpkhVei3qXmfPgsDHT3ixy8SQeHBisjI97+4Xlwpqm2V3oRtbUAlTER10a2I4RUEDEGu9kEDzPwTkn25jz7xepwRPgeml1cK1J4Do6GDkf965Da+s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784322108; c=relaxed/simple; bh=cFBBmXvEDqBEQsWEGmlWROEkg9KWX+tMjgiTpWeDrlo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PcPgdXun3DneVZJaSNgr5AoDK+CKfXjqx4N91ZUnpz3F6M/KKpHBInMtJk8whIGvekywUZjpekzr7nlV2UHTTWiSowcOHOc2EUvhSXMND6HBdWluH/D2W6ocICwfWCoBTQ/o3RZMWW/Rlq4i8egRgPjcr2Y8hD/+5Ra1wJBDnsc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sqj+SkBD; arc=none smtp.client-ip=209.85.215.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sqj+SkBD" Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-ca957432c7fso5766962a12.1 for ; Fri, 17 Jul 2026 14:01:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784322107; x=1784926907; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=qOgC41cSH851vnS2pphrQdfp5QFM6ijkK8rOKiA4LjM=; b=sqj+SkBDU3aguwb+jQiKg0KEwNGTJR0T0nz3qcwpxnPkDHbNHG2UxQrFx5Jp1qPtfD kpJG7KIHmkHcDP9BUFh1XgC2K/yv9dZ3D3AGlw3+CBzbO9uo1PngO4TZQ4624yxSYGek 2O+QvLLN6IXNUmeXCK3REAWnVcc72mXViGHLbEKTdAk7Y3ZsKXj7aoMLmvfAjUoE6oAi QuSM9NO8UIuufxdoNK17/bmc1RKXgLOUXuyc6AlLoh60v4Q2IDFmS5R5omtAm5OcNoIt y3qxyFFKiZcUzbRoPOtoQcYE2Dk9K6ruvh70e7NICyYwE9JR2sKa1zyQiWr+Lj6zQfne q3QA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784322107; x=1784926907; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qOgC41cSH851vnS2pphrQdfp5QFM6ijkK8rOKiA4LjM=; b=IanpbOTFH6l8GIaMtnv/jC7jUvD9HiKTlYfTVkENfYkd8ElKX+r+dP9yYPJzOoiZz2 Uw9L68XzTkvZPE4mSt5W5N5vGlZmKiwJVFZU2sMaNPGPsx2a7/irqlFrQJX0ojxweWUl gMoF49oy3W8yiUBd+3Rn7z/ki0Bf0ctCGg0vIMatWlc3zyjIDv7Lhk6GEJlIr15QSqNE eyU7ACjwRFoykdt+p5l7UR44teyJa2eTiPnqa/Glm6Y10AVT0z/SUGf6RgSWkq977xYF L45jPUMDkdzTtBGwwzgtKVUjsY3jC7Jp5yONReO7Kk6fIZCCqahMBtygz1jnd3OP/HZI fC9w== X-Forwarded-Encrypted: i=1; AHgh+Ro5gu5NKrsb4mSH+dtiHqd5d9rzPhgRmXaP1HnJE/pmMkdcMA5ejwgz2hbRddtRsK4nMSOgt9izEO2m5IA=@vger.kernel.org X-Gm-Message-State: AOJu0YyEAoBivMhdDLrmuBPJcDMXEadMUEoPgV1xL4W9ehE+hemUzTDp Z8cwETHHU3huLVLAHw9FV58e4XSM0xvFWObtazA+mKLqsB6T6aU4Pa8a X-Gm-Gg: AfdE7cmYZazT7WNO220TuR+Uyk2I5b4Au01X6mQHqPdQDnUMmzdPHnP9TLqJQLL1FRb /fzhrT5dbrzGo2qmgbRA3gB8+f5ay0DcpgnezpXFq0vYSrTRzeH7tj8gqiD9bnMT26fxNrS2SBf NbSjkg4h2auFwG1cazkwspuX9r+6+BvAIFkWSfpFip0Y4U/pSrnU88J5niB+ASLIwEuoIiyX9EX TdAnVG+tg9FnM4WbBSoy4hQEi18R/cu7auY9na0+vMVy9n8Qpa+pNCet+/KYEd+m7T8WAbM0QuT OlHsPCqse2QaePYQMFk9WOdl60ITF0MuOh3TZe4WNOaTjBNKyHKewr+Itb60gOpdtJZWZPEXTUJ nK5FY7+6CJGSviv05u0j4d7+ijZvOIXROl6yfqeVI/swq/Hlc8C4idBBs8RLIE04fTEUknQF1nS VA5dau22LqlEJrPvtkmd4= X-Received: by 2002:a17:90b:4a08:b0:380:9157:d6c with SMTP id 98e67ed59e1d1-38e4b41043cmr4616268a91.10.1784322106920; Fri, 17 Jul 2026 14:01:46 -0700 (PDT) Received: from LAPTOP-83ECOPAB.localdomain ([167.220.148.62]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e39de785dsm3515132a91.4.2026.07.17.14.01.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 14:01:46 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: brauner@kernel.org Cc: oleg@redhat.com, jack@suse.cz, avagin@gmail.com, ptikhomirov@virtuozzo.com, mjguzik@gmail.com, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH] pid: fix cad_pid use-after-free race in proc_do_cad_pid() Date: Fri, 17 Jul 2026 17:01:43 -0400 Message-ID: <20260717210143.4734-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit proc_do_cad_pid() reads the global cad_pid pointer and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free. Fix this by wrapping the read side in an RCU read-side critical section and waiting for a grace period before dropping the old cad_pid reference on the write side. Do not use call_rcu(&old_pid->rcu, ...) here: struct pid::rcu is already used by free_pid(), so queueing it again can corrupt the RCU callback list. KASAN crash stack: kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() kernel/pid.c:775 proc_do_cad_pid() fs/proc/proc_sysctl.c proc_sys_call_handler() fs/read_write.c vfs_read() fs/read_write.c __x64_sys_pread64() Fixes: 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) --- kernel/pid.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/pid.c b/kernel/pid.c index f55189a3d07d..fee62b2c0c7b 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -768,11 +768,15 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe size_t *lenp, loff_t *ppos) { struct pid *new_pid; + struct pid *old_pid; pid_t tmp_pid; int r; struct ctl_table tmp_table = *table; + rcu_read_lock(); tmp_pid = pid_vnr(cad_pid); + rcu_read_unlock(); + tmp_table.data = &tmp_pid; r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); @@ -783,7 +787,9 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe if (!new_pid) return -ESRCH; - put_pid(xchg(&cad_pid, new_pid)); + old_pid = xchg(&cad_pid, new_pid); + synchronize_rcu(); + put_pid(old_pid); return 0; } -- 2.53.0