From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93C27C4363A for ; Thu, 29 Oct 2020 15:52:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1A901207DE for ; Thu, 29 Oct 2020 15:52:18 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ughZoPhz" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728488AbgJ2PwR (ORCPT ); Thu, 29 Oct 2020 11:52:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49830 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728210AbgJ2PwQ (ORCPT ); Thu, 29 Oct 2020 11:52:16 -0400 Received: from mail-lf1-x144.google.com (mail-lf1-x144.google.com [IPv6:2a00:1450:4864:20::144]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5EF1FC0613D2 for ; Thu, 29 Oct 2020 08:52:16 -0700 (PDT) Received: by mail-lf1-x144.google.com with SMTP id i6so3972679lfd.1 for ; Thu, 29 Oct 2020 08:52:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gKj2b5AWCjhkAnY/6wcR30bVFmlXN2BZgELxg/l/4Qc=; b=ughZoPhz2Dl8WA8zbaZkOQUKXOfM6TdfudncnPkaH2w2VErcLZjrLnKsTYj9mJlE/U QyScXP5T9cnoE2IK6W+7gVNn+ZvWHcM22Y9ZUEwMyjzAfcNCZFNjFf9oXkbajJ8nqXJu bEyM3S50OwxEjqUUeuuznmQ1bCZuQpI1VW1kLSjYLsGB2o6JB1JVzY+BTtt2yaZMjXn3 YeZGcpo0qJzULk/nv1dnq5K8II6rmbN/8Xd0AJUP3d5A1Tf6EnQCpMo89CtdLZaPhvIx 4fESoUlvLp+JGBeT4hJZyH0SRxSf01ifp27P8Efe/SZDUwGaK+/Dos8pOuvl1MJ2KpFH bVew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gKj2b5AWCjhkAnY/6wcR30bVFmlXN2BZgELxg/l/4Qc=; b=UgIUiKshtJbQhCcsrc5KhD8SdVlKUaYFyeN4yICCohkI0zCtyO2qTHgeLqrf0A2c7c X1nZHcPUIjAkpofOPSEO8jaAkhPFL2br5++OK4sLjb/BOp0qU9Skg7iI8XkceNF/9M75 DcLbQx4YHOdvysGwUo00pvxizEfS06CZA4tnNrl9iQC7TDj4/gUPFh3BC4XijO8l9Kbb auGMNde0L3FGG6XR006KsOarhQtVj/eLRFrPixSxuVvb6T0NBYDJ3SamZOFKYccHHVNH iBYhfpclkrvXU9KkfXwEoZtxJSGjogx2ADGrTmEnRVZRrgH5ZfUpruPSTcKgIyoJOVEp XTZg== X-Gm-Message-State: AOAM530EwMI6HW6jZZhVXiUnegxuQXl3N7jxZ34SW4ukChvm8sRExfgY TaP1d7MTmD3hOfhEBK0h3TeieHCEF4oEuDCoV3cdQg== X-Google-Smtp-Source: ABdhPJw179Hs1WHKGbS1Wgn/thlA4WzmGkNhOsQywU69U7h93k8AVJNAwLgf8IFpAc1FdNmF5BFAi6HVO/s4D/JTPx4= X-Received: by 2002:a19:2355:: with SMTP id j82mr1728129lfj.385.1603986734575; Thu, 29 Oct 2020 08:52:14 -0700 (PDT) MIME-Version: 1.0 References: <20201028035013.99711-1-songmuchun@bytedance.com> <20201028035013.99711-2-songmuchun@bytedance.com> In-Reply-To: <20201028035013.99711-2-songmuchun@bytedance.com> From: Shakeel Butt Date: Thu, 29 Oct 2020 08:52:03 -0700 Message-ID: Subject: Re: [PATCH v2] mm: memcg/slab: Fix use after free in obj_cgroup_charge To: Muchun Song Cc: Johannes Weiner , Michal Hocko , Vladimir Davydov , Andrew Morton , Roman Gushchin , Joonsoo Kim , Yafang Shao , Chris Down , Christian Brauner , "Peter Zijlstra (Intel)" , Ingo Molnar , Kees Cook , Thomas Gleixner , esyr@redhat.com, Suren Baghdasaryan , areber@redhat.com, Marco Elver , LKML , Cgroups , Linux MM Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Oct 27, 2020 at 8:51 PM Muchun Song wrote: > > The rcu_read_lock/unlock only can guarantee that the memcg will > not be freed, but it cannot guarantee the success of css_get to > memcg. > > If the whole process of a cgroup offlining is completed between > reading a objcg->memcg pointer and bumping the css reference on > another CPU, and there are exactly 0 external references to this > memory cgroup (how we get to the obj_cgroup_charge() then?), > css_get() can change the ref counter from 0 back to 1. > > Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API") > Signed-off-by: Muchun Song > Acked-by: Roman Gushchin Reviewed-by: Shakeel Butt From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65556C55179 for ; Thu, 29 Oct 2020 15:52:19 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id BB1BA207DE for ; Thu, 29 Oct 2020 15:52:18 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ughZoPhz" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BB1BA207DE Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id DA14D6B005D; Thu, 29 Oct 2020 11:52:17 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D52686B0062; Thu, 29 Oct 2020 11:52:17 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C1AB26B0068; Thu, 29 Oct 2020 11:52:17 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0239.hostedemail.com [216.40.44.239]) by kanga.kvack.org (Postfix) with ESMTP id 949076B005D for ; Thu, 29 Oct 2020 11:52:17 -0400 (EDT) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 35A52824999B for ; Thu, 29 Oct 2020 15:52:17 +0000 (UTC) X-FDA: 77425404714.18.boys64_1e104332728e Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin18.hostedemail.com (Postfix) with ESMTP id E866D100ED3C3 for ; Thu, 29 Oct 2020 15:52:16 +0000 (UTC) X-HE-Tag: boys64_1e104332728e X-Filterd-Recvd-Size: 4065 Received: from mail-lf1-f66.google.com (mail-lf1-f66.google.com [209.85.167.66]) by imf35.hostedemail.com (Postfix) with ESMTP for ; Thu, 29 Oct 2020 15:52:16 +0000 (UTC) Received: by mail-lf1-f66.google.com with SMTP id j30so3943321lfp.4 for ; Thu, 29 Oct 2020 08:52:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gKj2b5AWCjhkAnY/6wcR30bVFmlXN2BZgELxg/l/4Qc=; b=ughZoPhz2Dl8WA8zbaZkOQUKXOfM6TdfudncnPkaH2w2VErcLZjrLnKsTYj9mJlE/U QyScXP5T9cnoE2IK6W+7gVNn+ZvWHcM22Y9ZUEwMyjzAfcNCZFNjFf9oXkbajJ8nqXJu bEyM3S50OwxEjqUUeuuznmQ1bCZuQpI1VW1kLSjYLsGB2o6JB1JVzY+BTtt2yaZMjXn3 YeZGcpo0qJzULk/nv1dnq5K8II6rmbN/8Xd0AJUP3d5A1Tf6EnQCpMo89CtdLZaPhvIx 4fESoUlvLp+JGBeT4hJZyH0SRxSf01ifp27P8Efe/SZDUwGaK+/Dos8pOuvl1MJ2KpFH bVew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gKj2b5AWCjhkAnY/6wcR30bVFmlXN2BZgELxg/l/4Qc=; b=IZmuOY20zsGkXyQr5wS3MiEyBjgrHU8oZo624iZVHUXrB5fdKhrI588KQJEQoqk2Xf tHYEbA+1j6gMVuUWfuE4hBhMb6E5WzGWFeepeGGx/B8WklFlbjmil68Vdzk1MLQBdkT5 e9C6LGaUYWIXHwYtvMWuFKeehfKD2rbD5YYIzkT6R04ByCDkmJNF3A27bRkxqYnoDXWM 8ugJTchHcCiClbF8MIACvdcKrJwRMWKEx9sWk3lL5tehqw7tbhFYogVJVu6T+1f8HLKK MWa9YxIF3Psb0iqu1g0PuvYtkF8P9tIUVd7ofTEmL8ROTS9Zo/SV+LrAgnl8aEFh6r0y g5mQ== X-Gm-Message-State: AOAM5333TKlYMsODFhkZ67sqPdM4nj2C+fFOkbhMWigtQGAf+fsT/F9G ZV/FK0T6dOBZOQmEM53PL8j3ez80pc8tOxgKwLNLXA== X-Google-Smtp-Source: ABdhPJw179Hs1WHKGbS1Wgn/thlA4WzmGkNhOsQywU69U7h93k8AVJNAwLgf8IFpAc1FdNmF5BFAi6HVO/s4D/JTPx4= X-Received: by 2002:a19:2355:: with SMTP id j82mr1728129lfj.385.1603986734575; Thu, 29 Oct 2020 08:52:14 -0700 (PDT) MIME-Version: 1.0 References: <20201028035013.99711-1-songmuchun@bytedance.com> <20201028035013.99711-2-songmuchun@bytedance.com> In-Reply-To: <20201028035013.99711-2-songmuchun@bytedance.com> From: Shakeel Butt Date: Thu, 29 Oct 2020 08:52:03 -0700 Message-ID: Subject: Re: [PATCH v2] mm: memcg/slab: Fix use after free in obj_cgroup_charge To: Muchun Song Cc: Johannes Weiner , Michal Hocko , Vladimir Davydov , Andrew Morton , Roman Gushchin , Joonsoo Kim , Yafang Shao , Chris Down , Christian Brauner , "Peter Zijlstra (Intel)" , Ingo Molnar , Kees Cook , Thomas Gleixner , esyr@redhat.com, Suren Baghdasaryan , areber@redhat.com, Marco Elver , LKML , Cgroups , Linux MM Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000039, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Oct 27, 2020 at 8:51 PM Muchun Song wrote: > > The rcu_read_lock/unlock only can guarantee that the memcg will > not be freed, but it cannot guarantee the success of css_get to > memcg. > > If the whole process of a cgroup offlining is completed between > reading a objcg->memcg pointer and bumping the css reference on > another CPU, and there are exactly 0 external references to this > memory cgroup (how we get to the obj_cgroup_charge() then?), > css_get() can change the ref counter from 0 back to 1. > > Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API") > Signed-off-by: Muchun Song > Acked-by: Roman Gushchin Reviewed-by: Shakeel Butt From mboxrd@z Thu Jan 1 00:00:00 1970 From: Shakeel Butt Subject: Re: [PATCH v2] mm: memcg/slab: Fix use after free in obj_cgroup_charge Date: Thu, 29 Oct 2020 08:52:03 -0700 Message-ID: References: <20201028035013.99711-1-songmuchun@bytedance.com> <20201028035013.99711-2-songmuchun@bytedance.com> Mime-Version: 1.0 Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gKj2b5AWCjhkAnY/6wcR30bVFmlXN2BZgELxg/l/4Qc=; b=ughZoPhz2Dl8WA8zbaZkOQUKXOfM6TdfudncnPkaH2w2VErcLZjrLnKsTYj9mJlE/U QyScXP5T9cnoE2IK6W+7gVNn+ZvWHcM22Y9ZUEwMyjzAfcNCZFNjFf9oXkbajJ8nqXJu bEyM3S50OwxEjqUUeuuznmQ1bCZuQpI1VW1kLSjYLsGB2o6JB1JVzY+BTtt2yaZMjXn3 YeZGcpo0qJzULk/nv1dnq5K8II6rmbN/8Xd0AJUP3d5A1Tf6EnQCpMo89CtdLZaPhvIx 4fESoUlvLp+JGBeT4hJZyH0SRxSf01ifp27P8Efe/SZDUwGaK+/Dos8pOuvl1MJ2KpFH bVew== In-Reply-To: <20201028035013.99711-2-songmuchun-EC8Uxl6Npydl57MIdRCFDg@public.gmane.org> List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Muchun Song Cc: Johannes Weiner , Michal Hocko , Vladimir Davydov , Andrew Morton , Roman Gushchin , Joonsoo Kim , Yafang Shao , Chris Down , Christian Brauner , "Peter Zijlstra (Intel)" , Ingo Molnar , Kees Cook , Thomas Gleixner , esyr-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, Suren Baghdasaryan , areber-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, Marco Elver , LKML , Cgroups , Linux MM On Tue, Oct 27, 2020 at 8:51 PM Muchun Song wrote: > > The rcu_read_lock/unlock only can guarantee that the memcg will > not be freed, but it cannot guarantee the success of css_get to > memcg. > > If the whole process of a cgroup offlining is completed between > reading a objcg->memcg pointer and bumping the css reference on > another CPU, and there are exactly 0 external references to this > memory cgroup (how we get to the obj_cgroup_charge() then?), > css_get() can change the ref counter from 0 back to 1. > > Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API") > Signed-off-by: Muchun Song > Acked-by: Roman Gushchin Reviewed-by: Shakeel Butt