Tejun Heo aad8bbd17a memcg: fix possible use-after-free in memcg_write_event_control() ... commit 4a7ba45b1a upstream. memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type. Link: https://lkml.kernel.org/r/Y5FRm/cfcKPGzWwl@slm.duckdns.org Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft") Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Jann Horn <jannh@google.com> Acked-by: Roman Gushchin <roman.gushchin@linux.dev> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Shakeel Butt <shakeelb@google.com> Cc: <stable@vger.kernel.org> [3.14+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-12-14 11:37:19 +01:00
..
cgroup-internal.h	memcg: fix possible use-after-free in memcg_write_event_control()	2022-12-14 11:37:19 +01:00
cgroup-v1.c	cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()	2022-09-23 14:15:52 +02:00
cgroup.c	cgroup: Honor caller's cgroup NS when resolving path	2022-10-26 12:35:24 +02:00
cpuset.c	cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset	2022-10-26 12:35:25 +02:00
debug.c	kernel: cgroup: fix misuse of %x	2019-05-06 08:47:48 -07:00
freezer.c	cgroup: freezer: don't change task and cgroups status unnecessarily	2019-11-07 07:38:41 -08:00
legacy_freezer.c	cgroup: rename freezer.c into legacy_freezer.c	2019-04-19 11:26:48 -07:00
Makefile	cgroup: Add misc cgroup controller	2021-04-04 13:34:46 -04:00
misc.c	svm/sev: Register SEV and SEV-ES ASIDs to the misc controller	2021-04-04 13:34:46 -04:00
namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
pids.c	clone3: allow spawning processes into cgroups	2020-02-12 17:57:51 -05:00
rdma.c	cgroup: fix spelling mistakes	2021-05-24 12:45:26 -04:00
rstat.c	cgroup: Fix rootcg cpu.stat guest double counting	2021-11-18 19:16:45 +01:00