From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9888C3A5A7 for ; Thu, 8 Dec 2022 03:44:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229699AbiLHDoI (ORCPT ); Wed, 7 Dec 2022 22:44:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229507AbiLHDoG (ORCPT ); Wed, 7 Dec 2022 22:44:06 -0500 Received: from out-5.mta0.migadu.com (out-5.mta0.migadu.com [IPv6:2001:41d0:1004:224b::5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E49987E413 for ; Wed, 7 Dec 2022 19:44:04 -0800 (PST) Date: Wed, 7 Dec 2022 19:43:54 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1670471039; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=PHzE9f0IRUY0L+BGXdPC0ZZnOe1x/EoBD8nxdnVzP/M=; b=vpawLfoYzk62tmgVNEmN5i8T2NCxM8fyGPGuFK7gqTTc/b4UNKhdNtVkDsglOiD7bxhqUE 6//7BfzL6tZuikORiTWga4fKG87s+XhgCLh0x6R+ICFivUvBWSSNyjRNTBg5DqVbbx6L8J YvqLamYDqJLmT4kHILPITmgw/sC4M8E= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Roman Gushchin To: Tejun Heo Cc: Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Jann Horn , Linus Torvalds , Johannes Weiner , Michal Hocko , Shakeel Butt , Muchun Song , cgroups@vger.kernel.org Subject: Re: [PATCH for-6.1-fixes] memcg: Fix possible use-after-free in memcg_write_event_control() Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Migadu-Flow: FLOW_OUT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Dec 07, 2022 at 04:53:15PM -1000, Tejun Heo wrote: > memcg_write_event_control() accesses the dentry->d_name of the specified > control fd to route the write call. As a cgroup interface file can't be > renamed, it's safe to access d_name as long as the specified file is a > regular cgroup file. Also, as these cgroup interface files can't be removed > before the directory, it's safe to access the parent too. > > Prior to 347c4a874710 ("memcg: remove cgroup_event->cft"), there was a call > to __file_cft() which verified that the specified file is a regular cgroupfs > file before further accesses. The cftype pointer returned from __file_cft() > was no longer necessary and the commit inadvertently dropped the file type > check with it allowing any file to slip through. With the invarients broken, > the d_name and parent accesses can now race against renames and removals of > arbitrary files and cause use-after-free's. > > Fix the bug by resurrecting the file type check in __file_cft(). Now that > cgroupfs is implemented through kernfs, checking the file operations needs > to go through a layer of indirection. Instead, let's check the superblock > and dentry type. > > Signed-off-by: Tejun Heo > Fixes: 347c4a874710 ("memcg: remove cgroup_event->cft") > Cc: stable@vger.kernel.org # v3.14+ > Reported-by: Jann Horn > Cc: Linus Torvalds Acked-by: Roman Gushchin Thanks!