c2dbe32d5d
If a non-root cgroup gets removed when there is a thread that registered trigger and is polling on a pressure file within the cgroup, the polling waitqueue gets freed in the following path: do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy However, the polling thread still has a reference to the pressure file and will access the freed waitqueue when the file is closed or upon exit: fput ep_eventpoll_release ep_free ep_remove_wait_queue remove_wait_queue This results in use-after-free as pasted below. The fundamental problem here is that cgroup_file_release() (and consequently waitqueue's lifetime) is not tied to the file's real lifetime. Using wake_up_pollfree() here might be less than ideal, but it is in line with the comment at commit |
||
---|---|---|
.. | ||
autogroup.c | ||
autogroup.h | ||
build_policy.c | ||
build_utility.c | ||
clock.c | ||
completion.c | ||
core.c | ||
core_sched.c | ||
cpuacct.c | ||
cpudeadline.c | ||
cpudeadline.h | ||
cpufreq.c | ||
cpufreq_schedutil.c | ||
cpupri.c | ||
cpupri.h | ||
cputime.c | ||
deadline.c | ||
debug.c | ||
fair.c | ||
features.h | ||
idle.c | ||
isolation.c | ||
loadavg.c | ||
Makefile | ||
membarrier.c | ||
pelt.c | ||
pelt.h | ||
psi.c | ||
rt.c | ||
sched-pelt.h | ||
sched.h | ||
smp.h | ||
stats.c | ||
stats.h | ||
stop_task.c | ||
swait.c | ||
topology.c | ||
wait.c | ||
wait_bit.c |