kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
No description
1,188,573 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Suren Baghdasaryan d124ab1702 sched/psi: use kernfs polling functions for PSI trigger polling 
[ Upstream commit aff037078e ]

Destroying psi trigger in cgroup_file_release causes UAF issues when
a cgroup is removed from under a polling process. This is happening
because cgroup removal causes a call to cgroup_file_release while the
actual file is still alive. Destroying the trigger at this point would
also destroy its waitqueue head and if there is still a polling process
on that file accessing the waitqueue, it will step on the freed pointer:

do_select
  vfs_poll
                           do_rmdir
                             cgroup_rmdir
                               kernfs_drain_open_files
                                 cgroup_file_release
                                   cgroup_pressure_release
                                     psi_trigger_destroy
                                       wake_up_pollfree(&t->event_wait)
// vfs_poll is unblocked
                                       synchronize_rcu
                                       kfree(t)
  poll_freewait -> UAF access to the trigger's waitqueue head

Patch [1] fixed this issue for epoll() case using wake_up_pollfree(),
however the same issue exists for synchronous poll() case.
The root cause of this issue is that the lifecycles of the psi trigger's
waitqueue and of the file associated with the trigger are different. Fix
this by using kernfs_generic_poll function when polling on cgroup-specific
psi triggers. It internally uses kernfs_open_node->poll waitqueue head
with its lifecycle tied to the file's lifecycle. This also renders the
fix in [1] obsolete, so revert it.

[1] commit c2dbe32d5d ("sched/psi: Fix use-after-free in ep_remove_wait_queue()")

Fixes: 0e94682b73 ("psi: introduce psi monitor")
Closes: https://lore.kernel.org/all/20230613062306.101831-1-lujialin4@huawei.com/
Reported-by: Lu Jialin <lujialin4@huawei.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20230630005612.1014540-1-surenb@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-07-27 08:56:53 +02:00
arch arm64: mm: fix VA-range sanity check 2023-07-27 08:56:47 +02:00
block blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none 2023-07-27 08:56:45 +02:00
certs KEYS: Add missing function documentation 2023-04-24 16:15:52 +03:00
crypto crypto: jitter - correct health test during initialization 2023-07-19 16:36:19 +02:00
Documentation media: uapi: Fix [GS]_ROUTING ACTIVE flag value 2023-07-23 13:54:08 +02:00
drivers net: hns3: fix strncpy() not using dest-buf length as length issue 2023-07-27 08:56:52 +02:00
fs erofs: Fix detection of atomic context 2023-07-27 08:56:46 +02:00
include sched/psi: use kernfs polling functions for PSI trigger polling 2023-07-27 08:56:53 +02:00
init kbuild: Fix CFI failures with GCOV 2023-07-19 16:36:23 +02:00
io_uring io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area() 2023-07-27 08:56:31 +02:00
ipc Merge branch 'work.namespace' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2023-02-24 19:20:07 -08:00
kernel sched/psi: use kernfs polling functions for PSI trigger polling 2023-07-27 08:56:53 +02:00
lib iov_iter: Mark copy_iovec_from_user() noclone 2023-07-27 08:56:53 +02:00
LICENSES LICENSES: Add the copyleft-next-0.3.1 license 2022-11-08 15:44:01 +01:00
mm mm/mlock: fix vma iterator conversion of apply_vma_lock_flags() 2023-07-27 08:56:32 +02:00
net wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() 2023-07-27 08:56:51 +02:00
rust Rust changes for v6.4 2023-04-30 11:20:22 -07:00
samples samples: ftrace: Save required argument registers in sample trampolines 2023-07-23 13:54:09 +02:00
scripts kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS 2023-07-19 16:37:00 +02:00
security keys: Fix linking a duplicate key to a keyring's assoc_array 2023-07-27 08:56:32 +02:00
sound ASoC: qcom: q6apm: do not close GPR port before closing graph 2023-07-27 08:56:52 +02:00
tools tools/nolibc: ensure stack protector guard is never zero 2023-07-27 08:56:48 +02:00
usr initramfs: Check negative timestamp to prevent broken cpio archive 2023-04-16 17:37:01 +09:00
virt KVM: Avoid illegal stage2 mapping on invalid memory slot 2023-06-22 15:14:57 -04:00
.clang-format cxl for v6.4 2023-04-30 11:51:51 -07:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore get_maintainer: add Alan to .get_maintainer.ignore 2022-08-20 15:17:44 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for *.dtso files 2023-02-26 15:28:23 +09:00
.gitignore linux-kselftest-kunit-6.4-rc1 2023-04-24 12:31:32 -07:00
.mailmap mailmap: add entries for Ben Dooks 2023-06-19 13:19:35 -07:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: sctp: move Neil to CREDITS 2023-05-12 08:51:32 +01:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS Networking fixes for 6.4-rc8, including fixes from ipsec, bpf, 2023-06-22 17:59:51 -07:00
Makefile Linux 6.4.6 2023-07-24 18:56:41 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.