From: Suren Baghdasaryan <surenb@google.com>
To: Eric Biggers <ebiggers@kernel.org>
Cc: Munehisa Kamata <kamatam@amazon.com>,
hannes@cmpxchg.org, hdanton@sina.com,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
mengcc@amazon.com, stable@vger.kernel.org
Subject: Re: [PATCH] sched/psi: fix use-after-free in ep_remove_wait_queue()
Date: Thu, 2 Feb 2023 13:11:36 -0800 [thread overview]
Message-ID: <CAJuCfpFb0J5ZwO6kncjRG0_4jQLXUy-_dicpH5uGiWP8aKYEJQ@mail.gmail.com> (raw)
In-Reply-To: <Y9tCl4r/qjqsrVj9@sol.localdomain>
On Wed, Feb 1, 2023 at 8:56 PM Eric Biggers <ebiggers@kernel.org> wrote:
>
> On Wed, Feb 01, 2023 at 07:00:23PM -0800, Munehisa Kamata wrote:
> > diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
> > index 8ac8b81bfee6..6e66c15f6450 100644
> > --- a/kernel/sched/psi.c
> > +++ b/kernel/sched/psi.c
> > @@ -1343,10 +1343,11 @@ void psi_trigger_destroy(struct psi_trigger *t)
> >
> > group = t->group;
> > /*
> > - * Wakeup waiters to stop polling. Can happen if cgroup is deleted
> > - * from under a polling process.
> > + * Wakeup waiters to stop polling and clear the queue to prevent it from
> > + * being accessed later. Can happen if cgroup is deleted from under a
> > + * polling process otherwise.
> > */
> > - wake_up_interruptible(&t->event_wait);
> > + wake_up_pollfree(&t->event_wait);
> >
> > mutex_lock(&group->trigger_lock);
>
> wake_up_pollfree() should only be used in extremely rare cases. Why can't the
> lifetime of the waitqueue be fixed instead?
waitqueue lifetime in this case is linked to cgroup_file_release(),
which seems appropriate to me here. Unfortunately
cgroup_file_release() is not directly linked to the file's lifetime.
For more details see:
https://lore.kernel.org/all/CAJuCfpFZ3B4530TgsSHqp5F_gwfrDujwRYewKReJru==MdEHQg@mail.gmail.com/#t
.
So, if we want to fix the lifetime of the waitqueue, we would have to
tie cgroup_file_release() to the fput() somehow. IOW, the fix would
have to be done at the cgroups or higher (kernfs?) layer.
Thanks,
Suren.
>
> - Eric
next prev parent reply other threads:[~2023-02-02 21:11 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CAJuCfpFZ3B4530TgsSHqp5F_gwfrDujwRYewKReJru==MdEHQg@mail.gmail.com>
2023-02-02 3:00 ` [PATCH] sched/psi: fix use-after-free in ep_remove_wait_queue() Munehisa Kamata
2023-02-02 4:56 ` Eric Biggers
2023-02-02 21:11 ` Suren Baghdasaryan [this message]
2023-02-09 17:09 ` Suren Baghdasaryan
2023-02-09 18:46 ` Eric Biggers
2023-02-09 19:13 ` Suren Baghdasaryan
2023-02-13 23:50 ` Suren Baghdasaryan
2023-02-14 7:04 ` [PATCH v2] " Munehisa Kamata
2023-02-14 17:10 ` Suren Baghdasaryan
2023-02-14 18:13 ` [PATCH v3] " Munehisa Kamata
2023-02-14 18:28 ` Suren Baghdasaryan
2023-02-14 18:29 ` Suren Baghdasaryan
2023-02-14 18:55 ` Eric Biggers
2023-02-14 19:13 ` Suren Baghdasaryan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJuCfpFb0J5ZwO6kncjRG0_4jQLXUy-_dicpH5uGiWP8aKYEJQ@mail.gmail.com \
--to=surenb@google.com \
--cc=ebiggers@kernel.org \
--cc=hannes@cmpxchg.org \
--cc=hdanton@sina.com \
--cc=kamatam@amazon.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mengcc@amazon.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).