Tejun Heo fbf8321238 memcg: Fix possible use-after-free in memcg_write_event_control() ... memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type. Signed-off-by: Tejun Heo <tj@kernel.org> Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft") Cc: stable@kernel.org # v3.14+ Reported-by: Jann Horn <jannh@google.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Acked-by: Roman Gushchin <roman.gushchin@linux.dev> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2022-12-08 10:40:58 -08:00
..
cgroup-internal.h	memcg: Fix possible use-after-free in memcg_write_event_control()	2022-12-08 10:40:58 -08:00
cgroup-v1.c	cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all()	2022-08-26 11:14:34 -10:00
cgroup.c	cgroup fixes for v6.1-rc1	2022-10-17 18:52:43 -07:00
cpuset.c	cgroup/cpuset: remove unreachable code	2022-09-07 05:30:29 -10:00
debug.c	kernel: cgroup: fix misuse of %x	2019-05-06 08:47:48 -07:00
freezer.c	cgroup: cleanup comments	2022-03-13 19:19:27 -10:00
legacy_freezer.c	freezer,sched: Rewrite core freezer logic	2022-09-07 21:53:50 +02:00
Makefile	cgroup: Add misc cgroup controller	2021-04-04 13:34:46 -04:00
misc.c	misc_cgroup: remove error log to avoid log flood	2021-09-20 07:35:38 -10:00
namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
pids.c	cgroup: add pids.peak interface for pids controller	2022-09-04 09:26:51 -10:00
rdma.c	cgroup: fix spelling mistakes	2021-05-24 12:45:26 -04:00
rstat.c	cgroup: bpf: enable bpf programs to integrate with rstat	2022-08-25 11:35:37 -07:00