From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9540B315793 for ; Mon, 15 Jun 2026 18:25:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.12 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781547910; cv=none; b=lDwVEAz+GV8wNl4e+G9wOQAl17v4h1X40OGTnlMfjHDaovg2N/fPZUOJUapziMpPdtA0j+jNufeQIUuZ3NCp5jw6oI2Dd18nz3MAo23jVLblwQbmXNUDB3Mdqk4oGWldXHlNt64qgm1VDUtm2/1Yfomfgkh2Hmmh8m/nsuK2CjA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781547910; c=relaxed/simple; bh=khZC/cb/YriYJ5rCY3qYgNgFYHgvXsuwbdEZkvXw7UU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=defLtGTPxD6BnMVElcqIHBjiGRP/mvXGr3Z6oaYXvE82KRBdoVkvMIihZY2D+B+32Nk32ILWhBIJ7wMblJEALoB6ueZuF88jY4cNzEucqDFqfmF+AU/ZEj/ChsgVd8PNsXeDVKsl66UWW+EGqentz61lasDQO2cE4T1pT3auPgM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=YgJ8Hd2J; arc=none smtp.client-ip=198.175.65.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="YgJ8Hd2J" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1781547908; x=1813083908; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=khZC/cb/YriYJ5rCY3qYgNgFYHgvXsuwbdEZkvXw7UU=; b=YgJ8Hd2J9hBU1RMWCSjPbJf7gzRzVeCp4P/o/ZVFbmJetBMQ+3QE82it xUVWbCQNxCIPUgCoUpc9JAaxw7H0BKtYUiyek5PLS4qugDmgDxnVnI/uI s9U89FCDZN26UpcOul1gcizQVVIBEsu0dvdO83cot+x3mw1Uw7GDg1hth 6QMWZ4UotxdV3uvnoWi5C2uvawHgj2u+h4OSJtNYhiPedLW4qhlo4Ej4E 7E90UiKDjXw/QW8rzupHSh1zevD12vqTPuanjGCyOyyRvbiDKu+iQ2LHR 5OAnA6Lw9Tlv9SDSOBI2E0vJaTpavrqkxoxWWeQoy7w05f8sqBpiV7eDl A==; X-CSE-ConnectionGUID: LhvGGHhqTk2bn5Uqd/+aBA== X-CSE-MsgGUID: 4h0kyCtMT/+BmnVy7VKwgg== X-IronPort-AV: E=McAfee;i="6800,10657,11818"; a="93789938" X-IronPort-AV: E=Sophos;i="6.24,206,1774335600"; d="scan'208";a="93789938" Received: from orviesa007.jf.intel.com ([10.64.159.147]) by orvoesa104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Jun 2026 11:25:07 -0700 X-CSE-ConnectionGUID: IJryhtrTTxakmndUQUWxkw== X-CSE-MsgGUID: 4zwEXoQoSQ6pYeBDz08UDw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,206,1774335600"; d="scan'208";a="247620604" Received: from spandruv-desk1.amr.corp.intel.com (HELO agluck-desk3.intel.com) ([10.124.221.121]) by orviesa007-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Jun 2026 11:25:06 -0700 From: Tony Luck To: Fenghua Yu , Reinette Chatre , Maciej Wieczor-Retman , Peter Newman , James Morse , Babu Moger , Drew Fustini , Dave Martin , Chen Yu , David E Box , x86@kernel.org Cc: Christoph Hellwig , linux-kernel@vger.kernel.org, patches@lists.linux.dev, Tony Luck , Sashiko Subject: [PATCH v8 03/16] fs/resctrl: Fix use-after-free during unmount Date: Mon, 15 Jun 2026 11:24:44 -0700 Message-ID: <20260615182457.14725-4-tony.luck@intel.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260615182457.14725-1-tony.luck@intel.com> References: <20260615182457.14725-1-tony.luck@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit During unmount or failure teardown all mon_data structures that contain monitoring event file private data are freed after which kernfs nodes are removed. However, the RDT_DELETED flag is never set for the statically allocated default resource group. A concurrent reader of an event file associated with the default resource group may, after dropping kernfs active protection, block on rdtgroup_mutex while unmount proceeds to free the file private data and destroy the kernfs node without waiting for the reader. When the mutex is released, the reader wakes up, observes that RDT_DELETED is not set for the default group, and dereferences the already-freed file private data. The scenario can be depicted as follows: CPU0 CPU1 /* * Default resource group's * monitoring data accessible via * kernfs file with kernfs_node::priv * pointing to a struct mon_data. * User opens the file for reading. */ rdtgroup_mondata_show() /* arch encounters fatal error */ rdtgroup_kn_lock_live() resctrl_exit() atomic_inc(&rdtgroup_default.waitcount) cpus_read_lock() kernfs_break_active_protection(kn) mutex_lock(&rdtgroup_mutex) cpus_read_lock() resctrl_fs_teardown() mutex_lock(&rdtgroup_mutex) rmdir_all_sub() mon_put_kn_priv() /* Delete all mon_data structures */ rdtgroup_destroy_root() kernfs_destroy_root() rdtgroup_default.kn = NULL mutex_unlock(&rdtgroup_mutex) /* * rdtgroup_default.flags is empty so * rdtgroup_kn_lock_live() returns * &rdtgroup_default */ md = of->kn->priv; /* md points to freed mon_data */ Set RDT_DELETED for the default group unconditionally since the flag does not lead to the freeing of this statically allocated group. Do not allow a new resctrl mount if there are any waiters on default group of previous mount. A new mount will re-initialize the default group that would appear to waiters from previous mount as though the default group is accessible causing them to access the mon_data structures from the previous mount that have been removed. Fixes: 2a6566038544 ("x86/resctrl: Expand the width of domid by replacing mon_data_bits") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260508182143.14592-1-tony.luck%40intel.com?part=2 [1] Signed-off-by: Tony Luck Signed-off-by: Reinette Chatre Reviewed-by: Chen Yu --- fs/resctrl/rdtgroup.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 506b40dc9430..ac3285ba8775 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -585,14 +585,20 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of, * * On resource group creation via a mkdir, an extra kernfs_node reference is * taken to ensure that the rdtgroup structure remains accessible for the - * rdtgroup_kn_unlock() calls where it is removed. + * rdtgroup_kn_unlock() calls where it is removed. The default group is + * statically allocated: it does not have an extra reference but will have + * RDT_DELETED set on unmount to support safe access to its associated files + * via rdtgroup_kn_lock_live/rdtgroup_kn_unlock(). * - * Drop the extra reference here, then free the rdtgroup structure. + * For all but the default group: drop the extra reference, then free the + * rdtgroup structure. * * Return: void */ static void rdtgroup_remove(struct rdtgroup *rdtgrp) { + if (rdtgrp == &rdtgroup_default) + return; kernfs_put(rdtgrp->kn); kfree(rdtgrp); } @@ -2965,6 +2971,7 @@ static void resctrl_fs_teardown(void) mon_put_kn_priv(); rdt_pseudo_lock_release(); rdtgroup_default.mode = RDT_MODE_SHAREABLE; + rdtgroup_default.flags = RDT_DELETED; closid_exit(); schemata_list_destroy(); rdtgroup_destroy_root(); @@ -2990,6 +2997,12 @@ static int rdt_get_tree(struct fs_context *fc) goto out; } + /* Avoid races from pending operations from a previous mount */ + if (atomic_read(&rdtgroup_default.waitcount) != 0) { + ret = -EBUSY; + goto out; + } + ret = setup_rmid_lru_list(); if (ret) goto out; @@ -4265,6 +4278,7 @@ static int rdtgroup_setup_root(struct rdt_fs_context *ctx) ctx->kfc.root = rdt_root; rdtgroup_default.kn = kernfs_root_to_node(rdt_root); + rdtgroup_default.flags = 0; return 0; } -- 2.54.0