From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD9A51531C8 for ; Sat, 18 Jul 2026 03:20:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784344812; cv=none; b=YFbOQ2KbmA1FHrLM+lyNRQy4uQUjbytSEOOGPsLwZ6DStRKqFC6kKqFyOahQ7G7Qb9G2AjfILcjY3de3Mqw6kKRvOWmYFHiQAVM579zhw9FzUyOnmEUhfank+k+fPzcYLSHhe6YCNeTx9Jx6bX3pFGzG4WET1fd/BGlCeqUL2hs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784344812; c=relaxed/simple; bh=nBTVj0RxpmOcH0opGkiRkbiAwqNT/Y/M7FSP+RwVFSc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Kdr7ANWAzqu4gx47avaeLr9iEb6CvlPOmiDHZcbBCIhBP2wASJSR4Eso408H4T2DHJHazJfct8sby//pNU5YUvOyk6spxGOIsaAY/BzQR8+AW5mnno+t63FkODUPYUxoRt4m2yrvylEWEPeyEqB5fn8G3rN0YYWhiRGVqn16Lig= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NdGdASgB; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NdGdASgB" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-383cb94f742so7885704a91.3 for ; Fri, 17 Jul 2026 20:20:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784344810; x=1784949610; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=j2TgCfh9RuuAPFagx/C6kXcDd5mt/kzQZXfzmhuGkxg=; b=NdGdASgBhZJI4xofjFwP8gWB8K5dbKbztk4nu5Iz4y4S4BsDJwrIVPFrI8OmO9WKWU rvFJMAVF/7S3sOrq51U5Jdfg+Sz9htJkBfwbAMLs+p8MGiNs1YqiFVyonzfdXxubHkMS t8sDw7V/iD3vlu0JZjyW9RRoaZlW+4Z1h6TPWT+Jj+2idNgrjmr9eHNpnskxsYaoErQw IzVL+dKOaLl90RVDWvbWvHslKyGLmKzzUv4g8LWIOIu8lExpr8SCyfqjYPWf2NoFLWkt wh7rTU7oB4VytHvpwtWnITb6FhuTQVTH5L1Wsg+HrPFBSEmNprkSVxdjL6TIlyCYRnsk 0J8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784344810; x=1784949610; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=j2TgCfh9RuuAPFagx/C6kXcDd5mt/kzQZXfzmhuGkxg=; b=lyWmyGx+dl6uNV6TQI5bzrznN/hegKDVAluUmuhYcAVllGSkJN5fvLWPsWrarLbGU0 tQihjiJdtYKRx9VgZBmmhsSC0Dn9umlM+crxJHbRMCyupMKOdZ5ZL6bUNkyCXdjVIBhf u76isTD2gKr3z6i69TF6FDog0If6sS2FGou4T1pClwIus5DhGAzBYwkeyWqDMF+9OJUe iHD/VPcovNqqsLMx0Svza1AwceCpb9+Z+EKHx0W4Jr46QlBCXVmigeC7oJPqm022Ofjl roxse8cN3xJChNUItiB4/9Z+PVCeBSmQ/648VMp+MrbPO+dNHaOieXSTt7jydUd4zXE6 NA+A== X-Forwarded-Encrypted: i=1; AHgh+RqcBimFXjn2O6aO7FMbBI111MaiiX52Y6Zm2MWqacH17iA5CAWdcq61YtcOfgVs+dC0hdFa789Iy5xvblU=@vger.kernel.org X-Gm-Message-State: AOJu0YzL+JwuBDr0rNCm+lOO82YJoalv+LjjEp6yvIutLSELaI9ajXQM PK9lLTbeosOFDOtcRmbgrYRudh5X8JKdaKbzzbQi+GqjI4ryfETpX5Km X-Gm-Gg: AfdE7cnGL9lh1WBh3TBec7vmTxNVrfx4IEVXjeST0tWUQwLXUhUf9xcH04tycT2alUJ KmI2e9fBqFFMcahUD6DGbDoD3a8UOJXWEy1jWK/kF0z3eXv3N5IgGqHjKU7E9lx6IBTwIcjZGIl cs/bzbywVaAZoAfy9PXrAOnf0FZ3zp95sqcy3j6B44N+2xPOUdSqw5yP+CpPFZtKhKvq2wGcF5t xpqjvCvBZs9kQ+unmQDwWUhju94KikavKuDEZvTX6Sf2KHsEAOq+OI7MF/gvwpGE24OvvFWn/w9 Uf6jzEpphjr30T3pDHSWcSWTjYVaNU8wyLtAJfaMUt2b/Fmznxllrlrbse+9s/0XsKE+TM5MiDy Emnj3k2jT4CRwXKflNJtrEwwDrhIxSlAtVH+PRn7bthOLo1LLeSU7R3ylElI3qDPyqKjyLNOdga mpQL9faRTwbhkuKJQVlZY= X-Received: by 2002:a17:90b:224e:b0:37f:9ce0:af36 with SMTP id 98e67ed59e1d1-38e4b5a823bmr5424623a91.33.1784344810035; Fri, 17 Jul 2026 20:20:10 -0700 (PDT) Received: from LAPTOP-83ECOPAB.localdomain ([167.220.148.62]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e4afd2dd6sm2035845a91.4.2026.07.17.20.20.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 20:20:09 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: brauner@kernel.org Cc: oleg@redhat.com, akpm@linux-foundation.org, jack@suse.cz, avagin@gmail.com, ptikhomirov@virtuozzo.com, mjguzik@gmail.com, include@grrlz.net, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com, stable@vger.kernel.org Subject: [PATCH v2 2/2] pid: fix cad_pid use-after-free race Date: Fri, 17 Jul 2026 23:20:00 -0400 Message-ID: <20260718032000.9184-2-blbllhy@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260718032000.9184-1-blbllhy@gmail.com> References: <20260718032000.9184-1-blbllhy@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit proc_do_cad_pid() reads the global cad_pid pointer and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free. The sysctl is mode 0600, but access is checked against the owning user namespace, so an unprivileged user can reach it via userns, pidns, and a proc mount. Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side. KASAN crash stack: kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() kernel/pid.c:775 proc_do_cad_pid() fs/proc/proc_sysctl.c proc_sys_call_handler() fs/read_write.c vfs_read() fs/read_write.c __x64_sys_pread64() Fixes: 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") Reported-by: AutonomousCodeSecurity@microsoft.com Closes: https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/ Suggested-by: Mateusz Guzik Reviewed-by: Bradley Morgan Cc: stable@vger.kernel.org Signed-off-by: Cen Zhang (Microsoft) --- v2: - Split out kill_cad_pid() deinline into a preparatory patch. - Annotate cad_pid as __rcu and use rcu_dereference(). - Protect kill_cad_pid() by taking a pid reference under RCU. - Add a comment explaining why synchronize_rcu() is used instead of call_rcu(). include/linux/sched.h | 2 +- init/main.c | 2 +- kernel/pid.c | 26 +++++++++++++++++++++++--- kernel/reboot.c | 2 +- 4 files changed, 26 insertions(+), 6 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 373bcc0598d1..31ce72b1233c 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1767,7 +1767,7 @@ static inline bool is_lazy_mmu_mode_active(void) } #endif -extern struct pid *cad_pid; +extern struct pid __rcu *cad_pid; /* * Per process flags diff --git a/init/main.c b/init/main.c index e363232b428b..19a10d0c2760 100644 --- a/init/main.c +++ b/init/main.c @@ -1636,7 +1636,7 @@ static noinline void __init kernel_init_freeable(void) */ set_mems_allowed(node_states[N_MEMORY]); - cad_pid = get_pid(task_pid(current)); + rcu_assign_pointer(cad_pid, get_pid(task_pid(current))); smp_prepare_cpus(setup_max_cpus); diff --git a/kernel/pid.c b/kernel/pid.c index 234ebee29375..bffc5f765080 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -559,7 +559,17 @@ EXPORT_SYMBOL_GPL(pid_vnr); int kill_cad_pid(int sig, int priv) { - return kill_pid(cad_pid, sig, priv); + struct pid *pid; + int ret; + + rcu_read_lock(); + pid = get_pid(rcu_dereference(cad_pid)); + rcu_read_unlock(); + + ret = kill_pid(pid, sig, priv); + put_pid(pid); + + return ret; } pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, @@ -773,11 +783,15 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe size_t *lenp, loff_t *ppos) { struct pid *new_pid; + struct pid *old_pid; pid_t tmp_pid; int r; struct ctl_table tmp_table = *table; - tmp_pid = pid_vnr(cad_pid); + rcu_read_lock(); + tmp_pid = pid_vnr(rcu_dereference(cad_pid)); + rcu_read_unlock(); + tmp_table.data = &tmp_pid; r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); @@ -788,7 +802,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe if (!new_pid) return -ESRCH; - put_pid(xchg(&cad_pid, new_pid)); + old_pid = unrcu_pointer(xchg(&cad_pid, RCU_INITIALIZER(new_pid))); + /* + * Wait for cad_pid readers before put_pid(). We cannot use + * call_rcu() here because free_pid() already owns pid->rcu. + */ + synchronize_rcu(); + put_pid(old_pid); return 0; } diff --git a/kernel/reboot.c b/kernel/reboot.c index 695c33e75efd..fc191a48c0e9 100644 --- a/kernel/reboot.c +++ b/kernel/reboot.c @@ -24,7 +24,7 @@ */ static int C_A_D = 1; -struct pid *cad_pid; +struct pid __rcu *cad_pid; EXPORT_SYMBOL(cad_pid); #if defined(CONFIG_ARM) -- 2.53.0