Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/kernel
History
Chen Ridong ddf2093c3e cgroup/cpuset: Prevent UAF in proc_cpuset_show() 
commit 1be59c97c83ccd67a519d8a49486b3a8a73ca28a upstream.

An UAF can happen when /proc/cpuset is read as reported in [1].

This can be reproduced by the following methods:
1.add an mdelay(1000) before acquiring the cgroup_lock In the
 cgroup_path_ns function.
2.$cat /proc/<pid>/cpuset   repeatly.
3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/
$umount /sys/fs/cgroup/cpuset/   repeatly.

The race that cause this bug can be shown as below:

(umount)		|	(cat /proc/<pid>/cpuset)
css_release		|	proc_cpuset_show
css_release_work_fn	|	css = task_get_css(tsk, cpuset_cgrp_id);
css_free_rwork_fn	|	cgroup_path_ns(css->cgroup, ...);
cgroup_destroy_root	|	mutex_lock(&cgroup_mutex);
rebind_subsystems	|
cgroup_free_root 	|
			|	// cgrp was freed, UAF
			|	cgroup_path_ns_locked(cgrp,..);

When the cpuset is initialized, the root node top_cpuset.css.cgrp
will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will
allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated
&cgroup_root.cgrp. When the umount operation is executed,
top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp.

The problem is that when rebinding to cgrp_dfl_root, there are cases
where the cgroup_root allocated by setting up the root for cgroup v1
is cached. This could lead to a Use-After-Free (UAF) if it is
subsequently freed. The descendant cgroups of cgroup v1 can only be
freed after the css is released. However, the css of the root will never
be released, yet the cgroup_root should be freed when it is unmounted.
This means that obtaining a reference to the css of the root does
not guarantee that css.cgrp->root will not be freed.

Fix this problem by using rcu_read_lock in proc_cpuset_show().
As cgroup_root is kfree_rcu after commit d23b5c577715
("cgroup: Make operations on the cgroup root_list RCU safe"),
css->cgroup won't be freed during the critical section.
To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to
replace task_get_css with task_css.

[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd

Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces")
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Shivani Agarwal <shivani.agarwal@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-01-19 14:59:05 +01:00
..
bpf bpf: fix potential error return 2025-01-15 16:29:56 +01:00
cgroup cgroup/cpuset: Prevent UAF in proc_cpuset_show() 2025-01-19 14:59:05 +01:00
configs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debug kdb: Use the passed prompt in kdb_position_cursor() 2024-11-23 23:20:16 +01:00
dma dma-debug: avoid deadlock between dma debug vs printk and netconsole 2025-01-19 14:53:28 +01:00
entry Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
events uprobes: Use kzalloc to allocate xol area 2025-01-19 00:09:58 +01:00
futex futex: Don't include process MM in futex key on no-MMU 2024-11-18 11:42:47 +01:00
gcov gcov: add support for GCC 14 2024-11-19 14:19:10 +01:00
irq kernel: Initialize cpumask before parsing 2025-01-15 16:29:54 +01:00
kcsan kcsan: Turn report_filterlist_lock into a raw_spinlock 2024-12-17 13:24:29 +01:00
livepatch kallsyms: refactor {,module_}kallsyms_on_each_symbol 2024-11-19 12:27:32 +01:00
locking ANDROID: GKI: Add initialization for mutex oem_data. 2025-01-19 14:56:36 +01:00
power Reapply "PM / freezer: Reduce freeze timeout to 1 second for Android" 2024-12-18 11:25:17 +01:00
printk printk: Silence useless system log spam 2024-11-19 18:04:40 +01:00
rcu rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow 2025-01-19 14:52:20 +01:00
sched sched: fair: tune BORE 2024-12-18 15:10:03 +01:00
time Reapply "timekeeping: Keep the tick alive when CPUs cycle out of s2idle" 2024-12-18 11:24:12 +01:00
trace tracing: Prevent bad count for tracing_cpumask_write 2025-01-15 16:29:54 +01:00
acct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
async.c async: Introduce async_schedule_dev_nocall() 2024-11-18 12:12:56 +01:00
audit.c audit: Send netlink ACK before setting connection in auditd_set 2024-11-18 12:13:09 +01:00
audit.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit_fsnotify.c fsnotify: make allow_dups a property of the group 2024-11-19 12:27:55 +01:00
audit_tree.c fsnotify: pass flags argument to fsnotify_alloc_group() 2024-11-19 12:27:55 +01:00
audit_watch.c fsnotify: pass flags argument to fsnotify_alloc_group() 2024-11-19 12:27:55 +01:00
auditfilter.c ima: Avoid blocking in RCU read-side critical section 2024-11-19 14:19:42 +01:00
auditsc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
backtracetest.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bounds.c bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS 2024-11-19 11:32:40 +01:00
capability.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cfi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
context_tracking.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cpu.c cpu: Silence log spam when a CPU is brought up 2024-11-19 18:04:55 +01:00
cpu_pm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crash_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crash_dump.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cred.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
delayacct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec_domain.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exit.c mm: optimize the redundant loop of mm_update_owner_next() 2024-11-19 14:19:41 +01:00
extable.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fail_function.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fork.c exec: Simplify unshare_files 2024-11-19 12:27:27 +01:00
freezer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gen_kheaders.sh kheaders: explicitly define file modes for archived headers 2024-11-19 14:19:30 +01:00
groups.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hung_task.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomem.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
irq_work.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jump_label.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kallsyms.c Import susfs4ksu 2025-01-18 21:48:58 +01:00
kcmp.c kcmp: In get_file_raw_ptr use task_lookup_fd_rcu 2024-11-19 12:27:27 +01:00
Kconfig.freezer Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.hz Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.locks Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.preempt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcov.c kcov: don't lose track of remote references during softirqs 2024-11-19 14:19:10 +01:00
kexec.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kheaders.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kmod.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kprobes.c Revert "x86/ibt,ftrace: Search for __fentry__ location" 2024-11-24 00:23:31 +01:00
ksysfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kthread.c Revert "kthread: add kthread_work tracepoints" 2024-11-24 00:23:23 +01:00
latencytop.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile kernel: Use the stock defconfig for /proc/config.gz 2024-06-15 16:20:14 -03:00
module-internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module.c Revert "kallsyms: Make module_kallsyms_on_each_symbol generally available" 2024-11-24 00:22:59 +01:00
module_signature.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module_signing.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsproxy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
padata.c Revert "padata: Honor the caller's alignment in case of chunk_size 0" 2024-11-24 00:23:30 +01:00
panic.c panic: Flush kernel log buffer at the end 2024-11-19 09:23:11 +01:00
params.c params: lift param_set_uint_minmax to common code 2024-11-19 12:27:09 +01:00
pid.c kernel/pid.c: implement additional checks upon pidfd_create() parameters 2024-11-19 12:27:43 +01:00
pid_namespace.c zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING 2024-11-19 14:19:05 +01:00
profile.c kernel: Initialize cpumask before parsing 2025-01-15 16:29:54 +01:00
ptrace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reboot.c kernel/reboot: emergency_restart: Set correct system_state 2024-11-18 11:43:25 +01:00
regset.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
relay.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
resource.c Revert "resource: fix region_intersects() vs add_memory_driver_managed()" 2024-11-24 00:22:55 +01:00
rseq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scftorture.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
seccomp.c seccomp: Invalidate seccomp mode to catch death failures 2024-11-18 22:25:35 +01:00
signal.c Revert "signal: Replace BUG_ON()s" 2024-11-24 00:23:07 +01:00
smp.c smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu() 2025-01-19 00:10:00 +01:00
smpboot.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smpboot.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
softirq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stackleak.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stacktrace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
static_call.c x86/static-call: provide a way to do very early static-call updates 2025-01-02 17:01:18 +01:00
stop_machine.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sys.c Import susfs4ksu 2025-01-18 21:48:58 +01:00
sys_ni.c syscalls: fix compat_sys_io_pgetevents_time64 usage 2024-11-19 14:19:34 +01:00
sysctl-test.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysctl.c 5.4 compile error fix: Use SYSCTL_ZERO and SYSCTL_ONE 2024-12-18 15:09:47 +01:00
task_work.c task_work: Introduce task_work_cancel() again 2024-11-23 23:20:13 +01:00
taskstats.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_kprobes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
torture.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tracepoint.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tsacct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ucount.c fanotify: configurable limits via sysfs 2024-11-19 12:27:37 +01:00
uid16.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uid16.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
umh.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
up.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user-return-notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
usermode_driver.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utsname.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utsname_sysctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watch_queue.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watchdog.c watchdog: move softlockup_panic back to early_param 2024-11-18 11:43:21 +01:00
watchdog_hld.c watchdog/perf: properly initialize the turbo mode timestamp and rearm counter 2024-11-23 23:20:15 +01:00
workqueue.c Revert "workqueue: Make queue_rcu_work() use call_rcu_flush()" 2024-11-19 18:15:40 +01:00
workqueue_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00