Re: [PATCH -next] cgroup: fix uaf when proc_cpuset_show

[Michal Koutný]

Hello.

On Tue, Jun 25, 2024 at 11:12:20AM GMT, chenridong <chenridong@xxxxxxxxxx> wrote:
> I am considering whether the cgroup framework has a method to fix this
> issue, as other subsystems may also have the same underlying problem.
> Since the root css will not be released, but the css->cgrp will be
> released.

<del>First part is already done in
	d23b5c5777158 ("cgroup: Make operations on the cgroup root_list RCU safe")
second part is that</del>
you need to take RCU read lock and check for NULL, similar to
	9067d90006df0 ("cgroup: Eliminate the need for cgroup_mutex in proc_cgroup_show()")

Does that make sense to you?

A Fixes: tag would be nice, it seems at least
	a79a908fd2b08 ("cgroup: introduce cgroup namespaces")
played some role. (Here the RCU lock is not for cgroup_roots list but to
preserve the root cgrp itself css_free_rwork_fn/cgroup_destroy_root.

HTH,
Michal

Attachment: signature.asc
Description: PGP signature