[PATCH v4] reboot: fix cad_pid use-after-free race

[PATCH v4] reboot: fix cad_pid use-after-free race

[Cen Zhang (Microsoft)]

cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().

At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.

Original KASAN crash stack:
  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

Fixes: 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid")
Reported-by: AutonomousCodeSecurity@microsoft.com
Closes: https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/
Link: https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/
Link: https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/
Suggested-by: Mateusz Guzik <mjguzik@gmail.com>
Suggested-by: Bradley Morgan <include@grrlz.net>
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Suggested-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: stable@vger.kernel.org
Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
---
v4:
 - Rebase on sysctl-next after Oleg's cad_pid sysctl placement change.
 - Fold the two-patch v3 series into a single lifetime fix.
 - Move kill_cad_pid() implementation to kernel/signal.c.
 - Export kill_cad_pid() and stop exporting the raw cad_pid pointer.
 - Update proc_do_cad_pid() in kernel/reboot.c.
 - Add explicit includes for the RCU API and kill_cad_pid().
 - Preserve the original unprivileged impact context while noting that
   the namespace permission path has been fixed separately.

v3:
 - Keep kill_cad_pid() inside the RCU read-side critical section
   instead of taking a pid reference, as suggested by Oleg.

v2:
 - Split out kill_cad_pid() deinline into a preparatory patch.
 - Annotate cad_pid as __rcu and use rcu_dereference().
 - Protect kill_cad_pid() by taking a pid reference under RCU.
 - Add a comment explaining why synchronize_rcu() is used instead of
   call_rcu().

 include/linux/sched.h        |  2 +-
 include/linux/sched/signal.h |  5 +----
 init/main.c                  |  2 +-
 kernel/reboot.c              | 19 +++++++++++++++----
 kernel/signal.c              | 12 ++++++++++++
 5 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 373bcc0598d1..31ce72b1233c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1767,7 +1767,7 @@ static inline bool is_lazy_mmu_mode_active(void)
 }
 #endif
 
-extern struct pid *cad_pid;
+extern struct pid __rcu *cad_pid;
 
 /*
  * Per process flags
diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
index 584ae88b435e..d45a5476b97d 100644
--- a/include/linux/sched/signal.h
+++ b/include/linux/sched/signal.h
@@ -562,10 +562,7 @@ static inline sigset_t *sigmask_to_save(void)
 	return res;
 }
 
-static inline int kill_cad_pid(int sig, int priv)
-{
-	return kill_pid(cad_pid, sig, priv);
-}
+int kill_cad_pid(int sig, int priv);
 
 /* These can be the second arg to send_sig_info/send_group_sig_info.  */
 #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)
diff --git a/init/main.c b/init/main.c
index e363232b428b..19a10d0c2760 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1636,7 +1636,7 @@ static noinline void __init kernel_init_freeable(void)
 	 */
 	set_mems_allowed(node_states[N_MEMORY]);
 
-	cad_pid = get_pid(task_pid(current));
+	rcu_assign_pointer(cad_pid, get_pid(task_pid(current)));
 
 	smp_prepare_cpus(setup_max_cpus);
 
diff --git a/kernel/reboot.c b/kernel/reboot.c
index f070c5c1103a..d177d89fcc33 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -13,7 +13,9 @@
 #include <linux/kexec.h>
 #include <linux/kmod.h>
 #include <linux/kmsg_dump.h>
+#include <linux/rcupdate.h>
 #include <linux/reboot.h>
+#include <linux/sched/signal.h>
 #include <linux/suspend.h>
 #include <linux/syscalls.h>
 #include <linux/syscore_ops.h>
@@ -24,8 +26,7 @@
  */
 
 static int C_A_D = 1;
-struct pid *cad_pid;
-EXPORT_SYMBOL(cad_pid);
+struct pid __rcu *cad_pid;
 
 #if defined(CONFIG_ARM)
 #define DEFAULT_REBOOT_MODE		= REBOOT_HARD
@@ -1371,10 +1372,14 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
 {
 	struct ctl_table tmp_table = *table;
 	struct pid *new_pid;
+	struct pid *old_pid;
 	pid_t tmp_pid;
 	int r;
 
-	tmp_pid = pid_vnr(cad_pid);
+	rcu_read_lock();
+	tmp_pid = pid_vnr(rcu_dereference(cad_pid));
+	rcu_read_unlock();
+
 	tmp_table.data = &tmp_pid;
 
 	r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
@@ -1385,7 +1390,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
 	if (!new_pid)
 		return -ESRCH;
 
-	put_pid(xchg(&cad_pid, new_pid));
+	old_pid = unrcu_pointer(xchg(&cad_pid, RCU_INITIALIZER(new_pid)));
+	/*
+	 * Wait for cad_pid readers before put_pid().  We cannot use
+	 * call_rcu() here because free_pid() already owns pid->rcu.
+	 */
+	synchronize_rcu();
+	put_pid(old_pid);
 	return 0;
 }
 
diff --git a/kernel/signal.c b/kernel/signal.c
index 9c2b32c4d755..464732c44554 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1891,6 +1891,18 @@ int kill_pid(struct pid *pid, int sig, int priv)
 }
 EXPORT_SYMBOL(kill_pid);
 
+int kill_cad_pid(int sig, int priv)
+{
+	int ret;
+
+	rcu_read_lock();
+	ret = kill_pid(rcu_dereference(cad_pid), sig, priv);
+	rcu_read_unlock();
+
+	return ret;
+}
+EXPORT_SYMBOL(kill_cad_pid);
+
 #ifdef CONFIG_POSIX_TIMERS
 /*
  * These functions handle POSIX timer signals. POSIX timers use

base-commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e
-- 
2.43.0

Re: [PATCH v4] reboot: fix cad_pid use-after-free race

[Bradley Morgan]

On 14 August 2026 05:09:44 BST, "Cen Zhang (Microsoft)" <blbllhy@gmail.com>
wrote:
>cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
>reads it and passes it to pid_vnr() without protecting the lifetime of
>the referenced struct pid. A concurrent writer can replace cad_pid and
>drop the final reference to the old struct pid after the reader has
>loaded the pointer but before pid_vnr() has finished dereferencing it,
>causing a use-after-free.
>
>kill_cad_pid() has the same lifetime race when it passes cad_pid to
>kill_pid().
>
>At the time this issue was reported, an unprivileged user could reach the
>sysctl through user and PID namespaces because cad_pid was registered in
>pid_table[]. Moving cad_pid back to the global reboot sysctl table
>corrected that namespace and permission mismatch, but did not fix the
>underlying lifetime race.
>
>Fix this by treating cad_pid as an RCU-protected pointer at both read
>sites and by waiting for a grace period before dropping the old reference
>on the write side.
>
>call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
>also queues pid->rcu; queueing the same rcu_head twice can corrupt the
>RCU callback list.
>
>Original KASAN crash stack:
>  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
>  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
>  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)
>
>Fixes: 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid")
>Reported-by: AutonomousCodeSecurity@microsoft.com
>Closes: https://lore.kernel.org/all/20260717210143.4734-1-blbllhy@gmail.com/
>Link: https://lore.kernel.org/all/alz5ZYLE4kaq_v2P@redhat.com/
>Link: https://lore.kernel.org/all/al4ICz9biJKtdZc4@redhat.com/
>Suggested-by: Mateusz Guzik <mjguzik@gmail.com>
>Suggested-by: Bradley Morgan <include@grrlz.net>

Yk what I'm gonna do...

Reviewed-by: Bradley Morgan <include@grrlz.net>


It kinda of makes sense in reboot code

>Suggested-by: Oleg Nesterov <oleg@redhat.com>
>Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
>Suggested-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
>Cc: stable@vger.kernel.org
>Signed-off-by: Cen Zhang (Microsoft) <blbllhy@gmail.com>
>---
>v4:
> - Rebase on sysctl-next after Oleg's cad_pid sysctl placement change.
> - Fold the two-patch v3 series into a single lifetime fix.
> - Move kill_cad_pid() implementation to kernel/signal.c.
> - Export kill_cad_pid() and stop exporting the raw cad_pid pointer.
> - Update proc_do_cad_pid() in kernel/reboot.c.
> - Add explicit includes for the RCU API and kill_cad_pid().
> - Preserve the original unprivileged impact context while noting that
>   the namespace permission path has been fixed separately.
>
>v3:
> - Keep kill_cad_pid() inside the RCU read-side critical section
>   instead of taking a pid reference, as suggested by Oleg.
>
>v2:
> - Split out kill_cad_pid() deinline into a preparatory patch.
> - Annotate cad_pid as __rcu and use rcu_dereference().
> - Protect kill_cad_pid() by taking a pid reference under RCU.
> - Add a comment explaining why synchronize_rcu() is used instead of
>   call_rcu().
>
> include/linux/sched.h        |  2 +-
> include/linux/sched/signal.h |  5 +----
> init/main.c                  |  2 +-
> kernel/reboot.c              | 19 +++++++++++++++----
> kernel/signal.c              | 12 ++++++++++++
> 5 files changed, 30 insertions(+), 10 deletions(-)
>
>diff --git a/include/linux/sched.h b/include/linux/sched.h
>index 373bcc0598d1..31ce72b1233c 100644
>--- a/include/linux/sched.h
>+++ b/include/linux/sched.h
>@@ -1767,7 +1767,7 @@ static inline bool is_lazy_mmu_mode_active(void)
> }
> #endif
> 
>-extern struct pid *cad_pid;
>+extern struct pid __rcu *cad_pid;
> 
> /*
>  * Per process flags
>diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h
>index 584ae88b435e..d45a5476b97d 100644
>--- a/include/linux/sched/signal.h
>+++ b/include/linux/sched/signal.h
>@@ -562,10 +562,7 @@ static inline sigset_t *sigmask_to_save(void)
> 	return res;
> }
> 
>-static inline int kill_cad_pid(int sig, int priv)
>-{
>-	return kill_pid(cad_pid, sig, priv);
>-}
>+int kill_cad_pid(int sig, int priv);
> 
> /* These can be the second arg to send_sig_info/send_group_sig_info.  */
> #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)
>diff --git a/init/main.c b/init/main.c
>index e363232b428b..19a10d0c2760 100644
>--- a/init/main.c
>+++ b/init/main.c
>@@ -1636,7 +1636,7 @@ static noinline void __init kernel_init_freeable(void)
> 	 */
> 	set_mems_allowed(node_states[N_MEMORY]);
> 
>-	cad_pid = get_pid(task_pid(current));
>+	rcu_assign_pointer(cad_pid, get_pid(task_pid(current)));
> 
> 	smp_prepare_cpus(setup_max_cpus);
> 
>diff --git a/kernel/reboot.c b/kernel/reboot.c
>index f070c5c1103a..d177d89fcc33 100644
>--- a/kernel/reboot.c
>+++ b/kernel/reboot.c
>@@ -13,7 +13,9 @@
> #include <linux/kexec.h>
> #include <linux/kmod.h>
> #include <linux/kmsg_dump.h>
>+#include <linux/rcupdate.h>
> #include <linux/reboot.h>
>+#include <linux/sched/signal.h>
> #include <linux/suspend.h>
> #include <linux/syscalls.h>
> #include <linux/syscore_ops.h>
>@@ -24,8 +26,7 @@
>  */
> 
> static int C_A_D = 1;
>-struct pid *cad_pid;
>-EXPORT_SYMBOL(cad_pid);
>+struct pid __rcu *cad_pid;
> 
> #if defined(CONFIG_ARM)
> #define DEFAULT_REBOOT_MODE		= REBOOT_HARD
>@@ -1371,10 +1372,14 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
> {
> 	struct ctl_table tmp_table = *table;
> 	struct pid *new_pid;
>+	struct pid *old_pid;
> 	pid_t tmp_pid;
> 	int r;
> 
>-	tmp_pid = pid_vnr(cad_pid);
>+	rcu_read_lock();
>+	tmp_pid = pid_vnr(rcu_dereference(cad_pid));
>+	rcu_read_unlock();
>+
> 	tmp_table.data = &tmp_pid;
> 
> 	r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
>@@ -1385,7 +1390,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
> 	if (!new_pid)
> 		return -ESRCH;
> 
>-	put_pid(xchg(&cad_pid, new_pid));
>+	old_pid = unrcu_pointer(xchg(&cad_pid, RCU_INITIALIZER(new_pid)));
>+	/*
>+	 * Wait for cad_pid readers before put_pid().  We cannot use
>+	 * call_rcu() here because free_pid() already owns pid->rcu.
>+	 */
>+	synchronize_rcu();
>+	put_pid(old_pid);
> 	return 0;
> }
> 
>diff --git a/kernel/signal.c b/kernel/signal.c
>index 9c2b32c4d755..464732c44554 100644
>--- a/kernel/signal.c
>+++ b/kernel/signal.c
>@@ -1891,6 +1891,18 @@ int kill_pid(struct pid *pid, int sig, int priv)
> }
> EXPORT_SYMBOL(kill_pid);
> 
>+int kill_cad_pid(int sig, int priv)
>+{
>+	int ret;
>+
>+	rcu_read_lock();
>+	ret = kill_pid(rcu_dereference(cad_pid), sig, priv);
>+	rcu_read_unlock();
>+
>+	return ret;
>+}
>+EXPORT_SYMBOL(kill_cad_pid);
>+
> #ifdef CONFIG_POSIX_TIMERS
> /*
>  * These functions handle POSIX timer signals. POSIX timers use
>
>base-commit: 8d75c338f0bcecaa6c9af67f86c176b67b6acf3e
>

Thanks!

Re: [PATCH v4] reboot: fix cad_pid use-after-free race

[Oleg Nesterov]

On 08/14, Cen Zhang (Microsoft) wrote:
>
> v4:
>  - Rebase on sysctl-next after Oleg's cad_pid sysctl placement change.
>  - Fold the two-patch v3 series into a single lifetime fix.
>  - Move kill_cad_pid() implementation to kernel/signal.c.
>  - Export kill_cad_pid() and stop exporting the raw cad_pid pointer.
>  - Update proc_do_cad_pid() in kernel/reboot.c.
>  - Add explicit includes for the RCU API and kill_cad_pid().
>  - Preserve the original unprivileged impact context while noting that
>    the namespace permission path has been fixed separately.

I don't see other changes in this version, so

Reviewed-by: Oleg Nesterov <oleg@redhat.com>