Tejun Heo
fbf8321238
memcg: Fix possible use-after-free in memcg_write_event_control()
...
memcg_write_event_control() accesses the dentry->d_name of the specified
control fd to route the write call. As a cgroup interface file can't be
renamed, it's safe to access d_name as long as the specified file is a
regular cgroup file. Also, as these cgroup interface files can't be
removed before the directory, it's safe to access the parent too.
Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a
call to __file_cft() which verified that the specified file is a regular
cgroupfs file before further accesses. The cftype pointer returned from
__file_cft() was no longer necessary and the commit inadvertently
dropped the file type check with it allowing any file to slip through.
With the invarients broken, the d_name and parent accesses can now race
against renames and removals of arbitrary files and cause
use-after-free's.
Fix the bug by resurrecting the file type check in __file_cft(). Now
that cgroupfs is implemented through kernfs, checking the file
operations needs to go through a layer of indirection. Instead, let's
check the superblock and dentry type.
Signed-off-by: Tejun Heo <[email protected] >
Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft")
Cc: [email protected] # v3.14+
Reported-by: Jann Horn <[email protected] >
Acked-by: Johannes Weiner <[email protected] >
Acked-by: Roman Gushchin <[email protected] >
Signed-off-by: Linus Torvalds <[email protected] >
2022-12-08 10:40:58 -08:00
..
2022-11-24 16:01:04 +01:00
2022-10-04 19:18:08 +02:00
2022-10-16 11:08:19 -07:00
2022-10-14 08:22:28 +01:00
2022-10-03 11:08:33 +01:00
2022-09-28 16:09:49 +01:00
2022-11-29 08:19:59 -08:00
2022-11-18 10:39:22 +01:00
2022-10-08 08:56:37 -07:00
2022-10-10 09:27:46 -07:00
2022-10-07 16:48:26 -07:00
2022-10-11 10:53:25 -07:00
2022-10-03 21:52:33 -07:00
2022-09-29 15:20:14 +01:00
2022-10-12 11:00:22 -07:00
2022-10-08 10:06:48 -07:00
2022-10-07 16:13:55 -07:00
2022-10-26 17:38:46 -07:00
2022-10-13 09:58:42 -07:00
2022-10-07 16:48:26 -07:00
2022-10-10 13:28:06 -07:00
2022-10-05 11:05:17 -06:00
2022-09-29 16:38:05 -07:00
2022-09-26 12:19:12 -07:00
2022-10-12 11:00:22 -07:00
2022-09-26 19:17:28 -06:00
2022-10-27 07:15:44 -06:00
2022-11-16 15:58:11 -07:00
2022-11-11 12:35:07 -08:00
2022-10-10 17:53:04 -07:00
2022-09-26 19:46:29 -07:00
2022-09-26 10:13:13 -07:00
2022-09-26 10:13:13 -07:00
2022-10-14 13:03:00 -07:00
2022-12-08 10:40:58 -08:00
2022-10-14 13:44:44 -07:00
2022-09-30 14:50:11 -07:00
2022-10-10 10:21:22 -07:00
2022-10-10 17:53:04 -07:00
2022-10-10 17:53:04 -07:00
2022-10-03 14:03:19 -07:00
2022-09-26 10:13:14 -07:00
2022-10-17 09:51:29 -04:00
2022-10-16 10:45:17 -07:00
2022-10-12 18:51:49 -07:00
2022-10-10 19:45:17 -07:00
2022-09-26 19:46:07 -07:00
2022-11-10 23:14:14 +01:00
2022-10-11 18:51:11 -07:00
2022-09-29 04:40:15 +09:00
2022-10-04 13:31:45 -07:00
2022-11-22 18:50:44 -08:00
2022-10-17 13:49:45 +02:00
2022-09-26 20:40:43 -07:00
2022-10-06 05:57:36 -07:00
2022-11-04 14:46:45 -07:00
2022-11-25 00:52:28 -05:00
2022-11-23 10:31:13 -08:00
2022-10-19 20:54:43 -07:00
2022-09-27 14:48:26 -04:00
2022-11-30 14:49:40 -08:00
2022-10-03 14:03:20 -07:00
2022-09-28 16:17:40 +01:00
2022-10-03 14:02:45 -07:00
2022-10-12 11:16:58 -07:00
2022-10-12 11:00:22 -07:00
2022-10-03 14:03:21 -07:00
2022-10-12 16:30:56 -06:00
2022-11-17 12:33:33 -07:00
2022-10-21 10:49:32 +02:00
2022-10-10 13:28:06 -07:00
2022-10-03 14:21:44 -07:00
2022-09-28 14:21:53 +01:00
2022-10-03 14:21:43 -07:00
2022-09-28 08:56:25 +02:00
2022-10-03 14:02:59 -07:00
2022-10-03 14:03:33 -07:00
2022-10-28 13:37:23 -07:00
2022-10-03 14:03:19 -07:00
2022-10-03 14:03:21 -07:00
2022-10-03 14:03:25 -07:00
2022-09-26 20:30:39 -07:00
2022-10-03 14:02:43 -07:00
2022-11-17 10:50:07 -05:00
2022-10-07 10:48:49 -07:00
2022-11-30 14:49:42 -08:00
2022-10-06 17:31:02 -07:00
2022-10-03 17:51:52 -07:00
2022-11-08 15:57:22 -08:00
2022-10-04 12:06:58 -06:00
2022-10-10 17:53:04 -07:00
2022-10-03 14:03:29 -07:00
2022-09-26 19:46:12 -07:00
2022-10-12 18:51:49 -07:00
2022-10-12 18:51:49 -07:00
2022-10-03 14:03:35 -07:00
2022-09-26 19:46:18 -07:00
2022-10-03 14:03:19 -07:00
2022-11-30 14:49:40 -08:00
2022-10-10 17:53:04 -07:00
2022-09-26 10:13:13 -07:00
2022-10-22 08:42:58 -06:00
2022-10-15 11:17:12 +01:00
2022-10-03 14:03:15 -07:00
2022-10-11 17:42:55 -06:00
2022-09-27 09:22:09 +02:00
2022-09-28 14:11:28 +01:00
2022-09-30 16:23:48 -05:00
2022-10-03 17:34:32 -07:00
2022-09-26 19:46:27 -07:00
2022-10-25 14:57:42 -07:00
2022-09-26 19:46:29 -07:00
2022-09-26 19:46:09 -07:00
2022-09-26 19:46:09 -07:00
2022-10-03 14:03:04 -07:00
2022-10-10 17:53:04 -07:00
2022-10-04 09:46:22 -07:00
2022-10-11 11:08:18 -07:00
2022-10-03 14:21:43 -07:00
2022-10-17 16:32:05 +02:00
2022-11-30 14:49:41 -08:00
2022-10-03 17:33:57 -07:00
2022-10-15 11:51:51 +01:00
2022-10-04 20:52:38 +02:00
2022-10-04 20:52:38 +02:00
2022-10-11 17:42:58 -06:00
2022-10-04 15:55:55 +02:00
2022-10-11 17:42:58 -06:00
2022-10-04 15:59:36 +02:00
2022-09-28 10:46:21 -06:00
2022-11-16 17:13:04 -05:00
2022-10-10 17:53:04 -07:00
2022-10-14 12:28:43 -07:00
2022-10-09 14:05:15 -07:00
2022-10-03 11:08:32 +01:00
2022-10-03 14:03:33 -07:00
2022-10-12 16:30:34 -06:00
2022-11-03 13:51:06 +01:00
2022-10-15 21:42:05 +02:00
2022-11-04 14:57:21 +01:00
2022-10-03 14:03:18 -07:00
2022-10-08 08:56:37 -07:00
2022-10-10 09:10:28 -07:00
2022-10-03 14:03:36 -07:00
2022-10-03 14:03:36 -07:00
2022-09-26 19:46:05 -07:00
2022-09-26 19:46:05 -07:00
2022-09-29 15:20:29 +02:00
2022-10-03 17:44:18 -07:00
2022-10-04 11:21:06 +02:00
2022-09-28 20:28:13 -04:00
2022-11-16 21:52:05 -05:00
2022-10-03 14:03:18 -07:00
2022-09-29 10:17:37 -04:00
2022-10-28 13:37:22 -07:00
2022-10-23 12:01:01 -07:00
2022-10-07 09:32:40 -04:00
2022-11-10 12:03:36 -07:00
2022-10-07 09:32:40 -04:00
2022-09-26 19:46:18 -07:00
2022-09-26 19:46:18 -07:00
2022-09-28 10:00:16 +02:00
2022-10-07 15:00:25 +02:00
2022-10-03 14:03:08 -07:00