Re: 5.10.225 stable kernel cgroup_mutex not held assertion failure

[Sasha Levin <sashal@kernel.org>]

On Wed, Sep 18, 2024 at 11:01:30PM -0700, Greg Thelen wrote:
>Linux stable v5.10.226 suffers a lockdep warning when accessing
>/proc/PID/cpuset. cset_cgroup_from_root() is called without cgroup_mutex
>is held, which causes assertion failure.
>
>Bisect blames 5.10.225 commit 688325078a8b ("cgroup/cpuset: Prevent UAF
>in proc_cpuset_show()"). I've have not easily reproduced the problem
>that this change fixes, so I'm not sure if it's best to revert the fix
>or adapt it to meet the 5.10 locking expectations.
>
>The lockdep complaint:
>
>$ cat /proc/1/cpuset
>$ dmesg
>[  198.744891] ------------[ cut here ]------------
>[  198.744918] WARNING: CPU: 4 PID: 9301 at 
>kernel/cgroup/cgroup.c:1395 cset_cgroup_from_root+0xb2/0xd0
>[  198.744957] RIP: 0010:cset_cgroup_from_root+0xb2/0xd0
>[  198.744960] Code: 02 00 00 74 11 48 8b 09 48 39 cb 75 eb eb 19 49 
>83 c6 10 4c 89 f0 48 85 c0 74 0d 5b 41 5e c3 48 8b 43 60 48 85 c0 75 
>f3 0f 0b <0f> 0b 83 3d 69 01 ee 01 00 0f 85 78 ff ff ff eb 8b 0f 0b eb 
>87 66
>[  198.744962] RSP: 0018:ffffb492608a7ce8 EFLAGS: 00010046
>[  198.744977] RAX: 0000000000000000 RBX: ffffffff8f4171b8 RCX: 
>cc949de848c33e00
>[  198.744979] RDX: 0000000000001000 RSI: ffffffff8f415450 RDI: 
>ffff92e5417c4dc0
>[  198.744981] RBP: ffff9303467e3f00 R08: 0000000000000008 R09: 
>ffffffff9122d568
>[  198.744983] R10: ffff92e5417c4380 R11: 0000000000000000 R12: 
>ffff92e3d9506000
>[  198.744984] R13: 0000000000000000 R14: ffff92e443a96000 R15: 
>ffff92e3d9506000
>[  198.744987] FS:  00007f15d94ed740(0000) GS:ffff9302bf500000(0000) 
>knlGS:0000000000000000
>[  198.744988] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[  198.744990] CR2: 00007f15d94ca000 CR3: 00000002816ca003 CR4: 
>00000000001706e0
>[  198.744992] Call Trace:
>[  198.744996]  ? __warn+0xcd/0x1c0
>[  198.745000]  ? cset_cgroup_from_root+0xb2/0xd0
>[  198.745008]  ? report_bug+0x87/0xf0
>[  198.745015]  ? handle_bug+0x42/0x80
>[  198.745017]  ? exc_invalid_op+0x16/0x70
>[  198.745021]  ? asm_exc_invalid_op+0x12/0x20
>[  198.745030]  ? cset_cgroup_from_root+0xb2/0xd0
>[  198.745034]  ? cset_cgroup_from_root+0x28/0xd0
>[  198.745038]  cgroup_path_ns_locked+0x23/0x50
>[  198.745044]  proc_cpuset_show+0x115/0x210
>[  198.745049]  proc_single_show+0x4a/0xa0
>[  198.745056]  seq_read_iter+0x14d/0x400
>[  198.745063]  seq_read+0x103/0x130
>[  198.745074]  vfs_read+0xea/0x320
>[  198.745078]  ? do_user_addr_fault+0x25b/0x390
>[  198.745085]  ? do_user_addr_fault+0x25b/0x390
>[  198.745090]  ksys_read+0x70/0xe0
>[  198.745096]  do_syscall_64+0x2d/0x40
>[  198.745099]  entry_SYSCALL_64_after_hwframe+0x61/0xcb

I'll queue up d23b5c577715 ("cgroup: Make operations on the cgroup
root_list RCU safe") onto 5.15/5.10. Thanks for reporting!

-- 
Thanks,
Sasha