Chen Ridong
854baafc00
kernfs: Fix UAF in polling when open file is released
commit 3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f upstream.
A use-after-free (UAF) vulnerability was identified in the PSI (Pressure
Stall Information) monitoring mechanism:
BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140
Read of size 8 at addr ffff3de3d50bd308 by task systemd/1
psi_trigger_poll+0x3c/0x140
cgroup_pressure_poll+0x70/0xa0
cgroup_file_poll+0x8c/0x100
kernfs_fop_poll+0x11c/0x1c0
ep_item_poll.isra.0+0x188/0x2c0
Allocated by task 1:
cgroup_file_open+0x88/0x388
kernfs_fop_open+0x73c/0xaf0
do_dentry_open+0x5fc/0x1200
vfs_open+0xa0/0x3f0
do_open+0x7e8/0xd08
path_openat+0x2fc/0x6b0
do_filp_open+0x174/0x368
Freed by task 8462:
cgroup_file_release+0x130/0x1f8
kernfs_drain_open_files+0x17c/0x440
kernfs_drain+0x2dc/0x360
kernfs_show+0x1b8/0x288
cgroup_file_show+0x150/0x268
cgroup_pressure_write+0x1dc/0x340
cgroup_file_write+0x274/0x548
Reproduction Steps:
1. Open test/cpu.pressure and establish epoll monitoring
2. Disable monitoring: echo 0 > test/cgroup.pressure
3. Re-enable monitoring: echo 1 > test/cgroup.pressure
The race condition occurs because:
1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it:
- Releases PSI triggers via cgroup_file_release()
- Frees of->priv through kernfs_drain_open_files()
2. While epoll still holds reference to the file and continues polling
3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv
epolling disable/enable cgroup.pressure
fd=open(cpu.pressure)
while(1)
...
epoll_wait
kernfs_fop_poll
kernfs_get_active = true echo 0 > cgroup.pressure
... cgroup_file_show
kernfs_show
// inactive kn
kernfs_drain_open_files
cft->release(of);
kfree(ctx);
...
kernfs_get_active = false
echo 1 > cgroup.pressure
kernfs_show
kernfs_activate_one(kn);
kernfs_fop_poll
kernfs_get_active = true
cgroup_file_poll
psi_trigger_poll
// UAF
...
end: close(fd)
To address this issue, introduce kernfs_get_active_of() for kernfs open
files to obtain active references. This function will fail if the open file
has been released. Replace kernfs_get_active() with kernfs_get_active_of()
to prevent further operations on released file descriptors.
Fixes: 34f26a1561 ("sched/psi: Per-cgroup PSI accounting disable/re-enable interface")
Cc: stable <stable@kernel.org>
Reported-by: Zhang Zhaotian <zhangzhaotian@huawei.com>
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20250822070715.1565236-2-chenridong@huaweicloud.com
[ Drop llseek bits ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-19 16:32:05 +02:00
..
2024-11-22 15:38:37 +01:00
2023-08-29 20:21:42 -07:00
2025-04-10 14:37:37 +02:00
2025-03-07 16:45:38 +01:00
2023-08-28 11:39:14 -07:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2025-09-19 16:32:04 +02:00
2025-07-24 08:53:16 +02:00
2025-07-06 11:00:08 +02:00
2023-08-28 09:31:32 -07:00
2025-06-27 11:08:42 +01:00
2024-08-19 06:04:25 +02:00
2025-08-28 16:28:40 +02:00
2024-01-20 11:51:37 +01:00
2023-08-28 10:17:14 -07:00
2025-06-04 14:41:57 +02:00
2024-10-04 16:29:48 +02:00
2025-09-04 15:30:26 +02:00
2023-08-29 20:21:42 -07:00
2025-09-04 15:30:19 +02:00
2025-08-28 16:28:28 +02:00
2023-08-29 17:45:22 -04:00
2025-08-28 16:28:15 +02:00
2025-08-28 16:28:44 +02:00
2025-08-28 16:28:36 +02:00
2024-10-22 15:46:20 +02:00
2023-08-29 20:21:42 -07:00
2024-12-09 10:31:45 +01:00
2025-09-19 16:32:04 +02:00
2025-08-28 16:28:15 +02:00
2025-08-28 16:28:15 +02:00
2025-08-28 16:28:14 +02:00
2025-04-10 14:37:34 +02:00
2023-08-29 20:21:42 -07:00
2025-08-28 16:28:39 +02:00
2025-05-02 07:51:01 +02:00
2025-07-24 08:53:13 +02:00
2025-08-28 16:28:36 +02:00
2025-06-27 11:08:58 +01:00
2025-08-28 16:28:26 +02:00
2025-09-19 16:32:05 +02:00
2024-08-19 06:04:23 +02:00
2023-08-29 20:21:42 -07:00
2023-09-18 12:03:46 -07:00
2025-09-19 16:32:02 +02:00
2023-04-13 13:13:52 -07:00
2025-09-19 16:32:01 +02:00
2025-08-01 09:47:30 +01:00
2023-08-31 12:07:34 -05:00
2025-08-15 12:08:52 +02:00
2023-08-29 20:21:42 -07:00
2025-08-28 16:28:15 +02:00
2025-09-19 16:32:03 +02:00
2023-08-29 20:21:42 -07:00
2024-06-12 11:11:30 +02:00
2025-08-28 16:28:25 +02:00
2025-07-06 11:00:08 +02:00
2025-09-19 16:32:02 +02:00
2025-06-04 14:42:11 +02:00
2023-08-29 20:21:42 -07:00
2023-08-29 20:21:42 -07:00
2024-12-09 10:33:01 +01:00
2023-07-24 10:30:04 +02:00
2024-08-19 06:04:26 +02:00
2024-08-19 06:04:25 +02:00
2025-09-19 16:32:05 +02:00
2025-08-28 16:28:43 +02:00
2024-04-27 17:11:41 +02:00
2024-04-13 13:07:34 +02:00
2025-08-28 16:28:15 +02:00
2025-02-08 09:52:28 +01:00
2025-08-28 16:28:15 +02:00
2023-08-29 20:21:42 -07:00
2024-12-14 20:00:20 +01:00
2025-03-22 12:50:41 -07:00
2024-06-16 13:47:33 +02:00
2025-09-04 15:30:29 +02:00
2024-02-23 09:25:13 +01:00
2024-04-03 15:28:44 +02:00
2025-07-10 16:03:18 +02:00
2023-08-28 10:17:14 -07:00
2023-08-11 09:04:57 +02:00
2024-08-29 17:33:33 +02:00
2025-05-22 14:12:12 +02:00
2025-02-17 09:40:16 +01:00
2024-08-29 17:33:27 +02:00
2025-08-28 16:28:44 +02:00
2023-05-15 09:42:01 +02:00
2025-06-04 14:42:24 +02:00
2023-05-17 09:16:59 +02:00
2024-11-08 16:28:19 +01:00
2024-07-25 09:50:54 +02:00
2023-06-28 10:28:11 -07:00
2023-08-18 10:12:11 -07:00
2023-07-11 11:41:34 +02:00
2025-08-28 16:28:12 +02:00
2025-04-10 14:37:44 +02:00
2024-10-04 16:29:56 +02:00
2024-08-19 06:04:28 +02:00
2025-02-08 09:51:42 +01:00
2025-08-28 16:28:50 +02:00
2025-06-19 15:28:43 +02:00
2023-10-12 18:53:36 +03:00
2022-12-01 10:46:54 -05:00
2023-08-21 13:46:25 -07:00
2025-09-09 18:56:20 +02:00
2023-08-14 18:48:02 +02:00
2023-01-19 09:24:28 +01:00
2024-12-09 10:31:41 +01:00
2023-08-29 20:21:42 -07:00
2024-01-31 16:18:54 -08:00
2025-04-25 10:45:46 +02:00
2023-08-23 14:17:43 -07:00
2023-08-19 12:12:12 +02:00
2025-08-28 16:28:15 +02:00
2024-07-27 11:34:10 +02:00
2023-08-02 09:13:09 -06:00
2022-12-08 21:49:25 -05:00
2023-01-19 09:24:30 +01:00
2023-04-18 16:30:02 -07:00
2025-03-22 12:50:44 -07:00
2025-08-28 16:28:44 +02:00
2023-07-13 10:28:04 +02:00
2024-11-01 01:58:32 +01:00
2024-04-10 16:35:57 +02:00
2023-05-19 04:30:22 +02:00
2023-05-19 04:30:22 +02:00
2023-07-13 10:28:04 +02:00
2023-05-24 08:42:16 -06:00
2023-08-15 08:32:45 +02:00
2023-08-06 15:08:35 +02:00
2023-05-24 11:03:59 +02:00
2025-03-22 12:50:37 -07:00
2022-11-25 13:01:55 -05:00
2025-05-02 07:50:45 +02:00
2023-07-13 10:28:04 +02:00
2023-12-03 07:33:03 +01:00
2023-05-17 15:20:17 +02:00
2024-08-19 06:04:25 +02:00
2023-05-23 21:43:26 -07:00
2025-04-25 10:45:31 +02:00
2023-02-20 11:53:11 -08:00
2025-06-27 11:08:57 +01:00