Tejun Heo f1f7f36cf6 memcg: fix possible use-after-free in memcg_write_event_control() ... commit 4a7ba45b1a435e7097ca0f79a847d0949d0eb088 upstream. memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup interface file can't be renamed, it's safe to access d_name as long as the specified file is a regular cgroup file. Also, as these cgroup interface files can't be removed before the directory, it's safe to access the parent too. Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a call to __file_cft() which verified that the specified file is a regular cgroupfs file before further accesses. The cftype pointer returned from __file_cft() was no longer necessary and the commit inadvertently dropped the file type check with it allowing any file to slip through. With the invarients broken, the d_name and parent accesses can now race against renames and removals of arbitrary files and cause use-after-free's. Fix the bug by resurrecting the file type check in __file_cft(). Now that cgroupfs is implemented through kernfs, checking the file operations needs to go through a layer of indirection. Instead, let's check the superblock and dentry type. Link: https://lkml.kernel.org/r/Y5FRm/cfcKPGzWwl@slm.duckdns.org Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft") Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Jann Horn <jannh@google.com> Acked-by: Roman Gushchin <roman.gushchin@linux.dev> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Muchun Song <songmuchun@bytedance.com> Cc: Shakeel Butt <shakeelb@google.com> Cc: <stable@vger.kernel.org> [3.14+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-12-14 11:31:57 +01:00
..
cgroup-internal.h	memcg: fix possible use-after-free in memcg_write_event_control()	2022-12-14 11:31:57 +01:00
cgroup-v1.c	cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()	2022-09-23 14:17:00 +02:00
cgroup.c	cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock	2022-09-15 11:32:04 +02:00
cpuset.c	cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset	2022-10-26 13:25:41 +02:00
debug.c	kernel: cgroup: fix misuse of %x	2019-05-06 08:47:48 -07:00
freezer.c	cgroup: freezer: don't change task and cgroups status unnecessarily	2019-11-07 07:38:41 -08:00
legacy_freezer.c	cgroup: rename freezer.c into legacy_freezer.c	2019-04-19 11:26:48 -07:00
Makefile	cgroup: cgroup v2 freezer	2019-04-19 11:26:48 -07:00
namespace.c	nsproxy: add struct nsset	2020-05-09 13:57:12 +02:00
pids.c	clone3: allow spawning processes into cgroups	2020-02-12 17:57:51 -05:00
rdma.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 451	2019-06-19 17:09:08 +02:00
rstat.c	cgroup: Fix rootcg cpu.stat guest double counting	2021-11-18 14:04:13 +01:00