From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Munehisa Kamata <kamatam@amazon.com>,
Mengchi Cheng <mengcc@amazon.com>, Ingo Molnar <mingo@kernel.org>,
Suren Baghdasaryan <surenb@google.com>,
Peter Zijlstra <peterz@infradead.org>
Subject: [PATCH 5.15 48/83] sched/psi: Fix use-after-free in ep_remove_wait_queue()
Date: Mon, 20 Feb 2023 14:36:21 +0100 [thread overview]
Message-ID: <20230220133555.348503007@linuxfoundation.org> (raw)
In-Reply-To: <20230220133553.669025851@linuxfoundation.org>
From: Munehisa Kamata <kamatam@amazon.com>
commit c2dbe32d5db5c4ead121cf86dabd5ab691fb47fe upstream.
If a non-root cgroup gets removed when there is a thread that registered
trigger and is polling on a pressure file within the cgroup, the polling
waitqueue gets freed in the following path:
do_rmdir
cgroup_rmdir
kernfs_drain_open_files
cgroup_file_release
cgroup_pressure_release
psi_trigger_destroy
However, the polling thread still has a reference to the pressure file and
will access the freed waitqueue when the file is closed or upon exit:
fput
ep_eventpoll_release
ep_free
ep_remove_wait_queue
remove_wait_queue
This results in use-after-free as pasted below.
The fundamental problem here is that cgroup_file_release() (and
consequently waitqueue's lifetime) is not tied to the file's real lifetime.
Using wake_up_pollfree() here might be less than ideal, but it is in line
with the comment at commit 42288cb44c4b ("wait: add wake_up_pollfree()")
since the waitqueue's lifetime is not tied to file's one and can be
considered as another special case. While this would be fixable by somehow
making cgroup_file_release() be tied to the fput(), it would require
sizable refactoring at cgroups or higher layer which might be more
justifiable if we identify more cases like this.
BUG: KASAN: use-after-free in _raw_spin_lock_irqsave+0x60/0xc0
Write of size 4 at addr ffff88810e625328 by task a.out/4404
CPU: 19 PID: 4404 Comm: a.out Not tainted 6.2.0-rc6 #38
Hardware name: Amazon EC2 c5a.8xlarge/, BIOS 1.0 10/16/2017
Call Trace:
<TASK>
dump_stack_lvl+0x73/0xa0
print_report+0x16c/0x4e0
kasan_report+0xc3/0xf0
kasan_check_range+0x2d2/0x310
_raw_spin_lock_irqsave+0x60/0xc0
remove_wait_queue+0x1a/0xa0
ep_free+0x12c/0x170
ep_eventpoll_release+0x26/0x30
__fput+0x202/0x400
task_work_run+0x11d/0x170
do_exit+0x495/0x1130
do_group_exit+0x100/0x100
get_signal+0xd67/0xde0
arch_do_signal_or_restart+0x2a/0x2b0
exit_to_user_mode_prepare+0x94/0x100
syscall_exit_to_user_mode+0x20/0x40
do_syscall_64+0x52/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
</TASK>
Allocated by task 4404:
kasan_set_track+0x3d/0x60
__kasan_kmalloc+0x85/0x90
psi_trigger_create+0x113/0x3e0
pressure_write+0x146/0x2e0
cgroup_file_write+0x11c/0x250
kernfs_fop_write_iter+0x186/0x220
vfs_write+0x3d8/0x5c0
ksys_write+0x90/0x110
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 4407:
kasan_set_track+0x3d/0x60
kasan_save_free_info+0x27/0x40
____kasan_slab_free+0x11d/0x170
slab_free_freelist_hook+0x87/0x150
__kmem_cache_free+0xcb/0x180
psi_trigger_destroy+0x2e8/0x310
cgroup_file_release+0x4f/0xb0
kernfs_drain_open_files+0x165/0x1f0
kernfs_drain+0x162/0x1a0
__kernfs_remove+0x1fb/0x310
kernfs_remove_by_name_ns+0x95/0xe0
cgroup_addrm_files+0x67f/0x700
cgroup_destroy_locked+0x283/0x3c0
cgroup_rmdir+0x29/0x100
kernfs_iop_rmdir+0xd1/0x140
vfs_rmdir+0xfe/0x240
do_rmdir+0x13d/0x280
__x64_sys_rmdir+0x2c/0x30
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: 0e94682b73bf ("psi: introduce psi monitor")
Signed-off-by: Munehisa Kamata <kamatam@amazon.com>
Signed-off-by: Mengchi Cheng <mengcc@amazon.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/lkml/20230106224859.4123476-1-kamatam@amazon.com/
Link: https://lore.kernel.org/r/20230214212705.4058045-1-kamatam@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/psi.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1169,10 +1169,11 @@ void psi_trigger_destroy(struct psi_trig
group = t->group;
/*
- * Wakeup waiters to stop polling. Can happen if cgroup is deleted
- * from under a polling process.
+ * Wakeup waiters to stop polling and clear the queue to prevent it from
+ * being accessed later. Can happen if cgroup is deleted from under a
+ * polling process.
*/
- wake_up_interruptible(&t->event_wait);
+ wake_up_pollfree(&t->event_wait);
mutex_lock(&group->trigger_lock);
next prev parent reply other threads:[~2023-02-20 13:52 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-20 13:35 [PATCH 5.15 00/83] 5.15.95-rc1 review Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 01/83] mptcp: fix locking for in-kernel listener creation Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 02/83] kprobes: treewide: Cleanup the error messages for kprobes Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 03/83] riscv: kprobe: Fixup misaligned load text Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 04/83] ACPI / x86: Add support for LPS0 callback handler Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 05/83] ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 06/83] ASoC: Intel: sof_cs42l42: " Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 07/83] selftests/bpf: Verify copy_register_state() preserves parent/live fields Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 08/83] ALSA: hda: Do not unset preset when cleaning up codec Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 09/83] bpf, sockmap: Dont let sock_map_{close,destroy,unhash} call itself Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 10/83] ASoC: cs42l56: fix DT probe Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 11/83] tools/virtio: fix the vringh test for virtio ring changes Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 12/83] net/rose: Fix to not accept on connected socket Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 13/83] net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 14/83] drm/nouveau/devinit/tu102-: wait for GFW_BOOT_PROGRESS == COMPLETED Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 15/83] net: sched: sch: Bounds check priority Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 16/83] s390/decompressor: specify __decompress() buf len to avoid overflow Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 17/83] nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 18/83] drm/amd/display: Properly handle additional cases where DCN is not supported Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 19/83] platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 20/83] nvmem: core: add error handling for dev_set_name Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 21/83] nvmem: core: fix cleanup after dev_set_name() Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 22/83] nvmem: core: fix registration vs use race Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 23/83] nvmem: core: fix return value Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 24/83] xfs: zero inode fork buffer at allocation Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 25/83] xfs: fix potential log item leak Greg Kroah-Hartman
2023-02-20 13:35 ` [PATCH 5.15 26/83] xfs: detect self referencing btree sibling pointers Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 27/83] xfs: set XFS_FEAT_NLINK correctly Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 28/83] xfs: validate v5 feature fields Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 29/83] xfs: avoid unnecessary runtime sibling pointer endian conversions Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 30/83] xfs: dont assert fail on perag references on teardown Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 31/83] xfs: assert in xfs_btree_del_cursor should take into account error Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 32/83] xfs: purge dquots after inode walk fails during quotacheck Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 33/83] xfs: dont leak btree cursor when insrec fails after a split Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 34/83] mptcp: do not wait for bare sockets timeout Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 35/83] aio: fix mremap after fork null-deref Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 36/83] drm/amd/display: Fail atomic_check early on normalize_zpos error Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 37/83] platform/x86: amd-pmc: Export Idlemask values based on the APU Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 38/83] platform/x86: amd-pmc: Fix compilation when CONFIG_DEBUGFS is disabled Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 39/83] platform/x86: amd-pmc: Correct usage of SMU version Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 40/83] platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 41/83] netfilter: nft_tproxy: restrict to prerouting hook Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 42/83] tcp: Fix listen() regression in 5.15.88 Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 43/83] mmc: jz4740: Work around bug on JZ4760(B) Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 44/83] mmc: sdio: fix possible resource leaks in some error paths Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 45/83] mmc: mmc_spi: fix error handling in mmc_spi_probe() Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 46/83] ALSA: hda/conexant: add a new hda codec SN6180 Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 47/83] ALSA: hda/realtek - fixed wrong gpio assigned Greg Kroah-Hartman
2023-02-20 13:36 ` Greg Kroah-Hartman [this message]
2023-02-20 13:36 ` [PATCH 5.15 49/83] hugetlb: check for undefined shift on 32 bit architectures Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 50/83] of: reserved_mem: Have kmemleak ignore dynamically allocated reserved mem Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 51/83] selftest/lkdtm: Skip stack-entropy test if lkdtm is not available Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 52/83] Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 53/83] net: Fix unwanted sign extension in netdev_stats_to_stats64() Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 54/83] revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 55/83] ixgbe: allow to increase MTU to 3K with XDP enabled Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 56/83] i40e: add double of VLAN header when computing the max MTU Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 57/83] net: bgmac: fix BCM5358 support by setting correct flags Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 58/83] net: ethernet: ti: am65-cpsw: Add RX DMA Channel Teardown Quirk Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 59/83] sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 60/83] net/sched: tcindex: update imperfect hash filters respecting rcu Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 61/83] dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 62/83] net/usb: kalmia: Dont pass act_len in usb_bulk_msg error path Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 63/83] net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 64/83] net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 65/83] bnxt_en: Fix mqprio and XDP ring checking logic Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 66/83] net: stmmac: Restrict warning on disabling DMA store and fwd mode Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 67/83] net: mpls: fix stale pointer if allocation fails during device rename Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 68/83] ixgbe: add double of VLAN header when computing the max MTU Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 69/83] ipv6: Fix datagram socket connection with DSCP Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 70/83] ipv6: Fix tcp " Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 71/83] nilfs2: fix underflow in second superblock position calculations Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 72/83] mm/filemap: fix page end in filemap_get_read_batch Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 73/83] drm/i915/gen11: Moving WAs to icl_gt_workarounds_init() Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 74/83] drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 75/83] flow_offload: fill flags to action structure Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 76/83] net/sched: act_ctinfo: use percpu stats Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 77/83] i40e: Add checking for null for nlmsg_find_attr() Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 78/83] net/sched: tcindex: search key must be 16 bits Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 79/83] kvm: initialize all of the kvm_debugregs structure before sending it to userspace Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 80/83] alarmtimer: Prevent starvation by small intervals and SIG_IGN Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 81/83] ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 82/83] net: sched: sch: Fix off by one in htb_activate_prios() Greg Kroah-Hartman
2023-02-20 13:36 ` [PATCH 5.15 83/83] platform/x86/amd: pmc: add CONFIG_SERIO dependency Greg Kroah-Hartman
2023-02-21 4:10 ` [PATCH 5.15 00/83] 5.15.95-rc1 review Bagas Sanjaya
2023-02-21 7:09 ` Naresh Kamboju
2023-02-21 12:04 ` Ron Economos
2023-02-21 14:57 ` Sudip Mukherjee (Codethink)
2023-02-21 16:21 ` Guenter Roeck
2023-02-21 20:10 ` Florian Fainelli
2023-02-21 23:48 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230220133555.348503007@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kamatam@amazon.com \
--cc=mengcc@amazon.com \
--cc=mingo@kernel.org \
--cc=patches@lists.linux.dev \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).