Re: FAILED: patch "[PATCH] sched/core: Fix use-after-free bug in dup_user_cpus_ptr()" failed to apply to 6.1-stable tree

[Ingo Molnar <mingo@kernel.org>]

* Waiman Long <longman@redhat.com> wrote:

> 
> On 1/14/23 14:33, Waiman Long wrote:
> > On 1/14/23 14:28, Waiman Long wrote:
> > > On 1/14/23 04:53, gregkh@linuxfoundation.org wrote:
> > > > The patch below does not apply to the 6.1-stable tree.
> > > > If someone wants it applied there, or to any other stable or longterm
> > > > tree, then please email the backport, including the original git commit
> > > > id to <stable@vger.kernel.org>.
> > > > 
> > > > Possible dependencies:
> > > > 
> > > > 87ca4f9efbd7 ("sched/core: Fix use-after-free bug in
> > > > dup_user_cpus_ptr()")
> > > > 8f9ea86fdf99 ("sched: Always preserve the user requested cpumask")
> > > > 713a2e21a513 ("sched: Introduce affinity_context")
> > > > 
> > > > thanks,
> > > > 
> > > > greg k-h
> > > > 
> > > > ------------------ original commit in Linus's tree ------------------
> > > > 
> > > >  From 87ca4f9efbd7cc649ff43b87970888f2812945b8 Mon Sep 17 00:00:00 2001
> > > > From: Waiman Long <longman@redhat.com>
> > > > Date: Fri, 30 Dec 2022 23:11:19 -0500
> > > > Subject: [PATCH] sched/core: Fix use-after-free bug in
> > > > dup_user_cpus_ptr()
> > > > MIME-Version: 1.0
> > > > Content-Type: text/plain; charset=UTF-8
> > > > Content-Transfer-Encoding: 8bit
> > > > 
> > > > Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be
> > > > restricted on asymmetric systems"), the setting and clearing of
> > > > user_cpus_ptr are done under pi_lock for arm64 architecture. However,
> > > > dup_user_cpus_ptr() accesses user_cpus_ptr without any lock
> > > > protection. Since sched_setaffinity() can be invoked from another
> > > > process, the process being modified may be undergoing fork() at
> > > > the same time.  When racing with the clearing of user_cpus_ptr in
> > > > __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and
> > > > possibly double-free in arm64 kernel.
> > > > 
> > > > Commit 8f9ea86fdf99 ("sched: Always preserve the user requested
> > > > cpumask") fixes this problem as user_cpus_ptr, once set, will never
> > > > be cleared in a task's lifetime. However, this bug was re-introduced
> > > > in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in
> > > > do_set_cpus_allowed()") which allows the clearing of user_cpus_ptr in
> > > > do_set_cpus_allowed(). This time, it will affect all arches.
> > > > 
> > > > Fix this bug by always clearing the user_cpus_ptr of the newly
> > > > cloned/forked task before the copying process starts and check the
> > > > user_cpus_ptr state of the source task under pi_lock.
> > > > 
> > > > Note to stable, this patch won't be applicable to stable releases.
> > > > Just copy the new dup_user_cpus_ptr() function over.
> > > 
> > > I have a note here about what to do when backporting to stable. Just
> > > copy the new function over will be fine.
> > 
> > That will be before the application of the subsequent patch which will
> > modify it in a way for suitable for stable. I can send out a separate
> > stable patch for that later today.
> 
> The attached patch will apply to linux-6.1.y as well as linux-5.15.y.

Thanks!

Acked-by: Ingo Molnar <mingo@kernel.org>


	Ingo