Re: [PATCH 6.6 017/568] cgroup/cpuset: Prevent UAF in proc_cpuset_show()

On Wed, Aug 14, 2024 at 02:05:59PM +0200, Michal Koutný wrote:

Hello.

On Tue, Jul 30, 2024 at 05:42:04PM GMT, Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:

...

... Fix this problem by using rcu_read_lock in proc_cpuset_show(). As cgroup_root is kfree_rcu after commit d23b5c577715 ("cgroup: Make operations on the cgroup root_list RCU safe"), css->cgroup won't be freed during the critical section. To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to replace task_get_css with task_css.

This backport requires also the mentioned d23b5c577715 to be effective (I noticed that is missing in 6.6.y at the moment).

It is in 6.6.44.

thanks,

greg k-h