Tejun Heo 35963b3182 memcg: fix possible use-after-free in memcg_write_event_control() ... commit 4a7ba45b1a upstream. memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type. Link: https://lkml.kernel.org/r/Y5FRm/cfcKPGzWwl@slm.duckdns.org Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft") Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Jann Horn <jannh@google.com> Acked-by: Roman Gushchin <roman.gushchin@linux.dev> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Shakeel Butt <shakeelb@google.com> Cc: <stable@vger.kernel.org> [3.14+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-12-14 11:30:43 +01:00
..
cgroup-internal.h	memcg: fix possible use-after-free in memcg_write_event_control()	2022-12-14 11:30:43 +01:00
cgroup-v1.c	cgroup-v1: add disabled controller check in cgroup1_parse_param()	2022-11-03 23:56:54 +09:00
cgroup.c	cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock	2022-09-15 12:04:54 +02:00
cpuset.c	cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset	2022-10-26 13:22:45 +02:00
debug.c	kernel: cgroup: fix misuse of %x	2019-05-06 08:47:48 -07:00
freezer.c	cgroup: freezer: don't change task and cgroups status unnecessarily	2019-12-31 16:45:06 +01:00
legacy_freezer.c	cgroup: rename freezer.c into legacy_freezer.c	2019-04-19 11:26:48 -07:00
Makefile	cgroup: cgroup v2 freezer	2019-04-19 11:26:48 -07:00
namespace.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
pids.c	cgroup: pids: use atomic64_t for pids->limit	2019-12-17 19:56:15 +01:00
rdma.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 451	2019-06-19 17:09:08 +02:00
rstat.c	Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window"	2020-06-07 13:18:46 +02:00