Files
linux/include/linux
Tejun Heo f1f7f36cf6 memcg: fix possible use-after-free in memcg_write_event_control()
commit 4a7ba45b1a upstream.

memcg_write_event_control() accesses the dentry->d_name of the specified
control fd to route the write call.  As a cgroup interface file can't be
renamed, it's safe to access d_name as long as the specified file is a
regular cgroup file.  Also, as these cgroup interface files can't be
removed before the directory, it's safe to access the parent too.

Prior to 347c4a8747 ("memcg: remove cgroup_event->cft"), there was a
call to __file_cft() which verified that the specified file is a regular
cgroupfs file before further accesses.  The cftype pointer returned from
__file_cft() was no longer necessary and the commit inadvertently dropped
the file type check with it allowing any file to slip through.  With the
invarients broken, the d_name and parent accesses can now race against
renames and removals of arbitrary files and cause use-after-free's.

Fix the bug by resurrecting the file type check in __file_cft().  Now that
cgroupfs is implemented through kernfs, checking the file operations needs
to go through a layer of indirection.  Instead, let's check the superblock
and dentry type.

Link: https://lkml.kernel.org/r/Y5FRm/cfcKPGzWwl@slm.duckdns.org
Fixes: 347c4a8747 ("memcg: remove cgroup_event->cft")
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Jann Horn <jannh@google.com>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <songmuchun@bytedance.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: <stable@vger.kernel.org>	[3.14+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-12-14 11:31:57 +01:00
..
2022-12-02 17:40:03 +01:00
2022-08-21 15:16:16 +02:00
2020-06-25 22:25:13 -07:00
2020-06-16 14:19:57 +02:00
2022-10-26 13:25:35 +02:00
2020-05-24 20:48:11 +02:00
2020-09-21 15:00:40 -07:00
2020-10-02 15:00:49 -07:00
2020-10-16 17:21:51 +02:00
2022-07-07 17:52:17 +02:00
2020-03-09 11:12:19 +01:00
2020-06-16 19:25:20 +02:00
2020-08-12 20:42:08 +02:00
2020-06-17 00:07:38 +02:00
2020-07-24 17:12:41 -07:00
2020-08-04 21:02:38 -04:00
2022-10-26 13:25:42 +02:00
2020-09-16 08:54:53 -05:00
2022-04-13 21:00:56 +02:00
2020-05-18 10:30:21 +01:00
2020-08-26 12:41:56 +02:00
2020-11-19 22:38:29 -05:00
2020-10-13 18:38:32 -07:00
2020-06-02 15:15:46 +01:00
2021-03-04 11:37:59 +01:00
2022-08-21 15:16:08 +02:00
2020-09-04 09:25:20 -07:00
2021-02-07 15:37:17 +01:00
2021-11-18 14:03:37 +01:00
2020-05-08 18:18:11 +01:00
2020-05-08 00:12:42 +02:00
2020-05-28 10:31:09 +02:00
2020-03-06 11:56:59 +01:00
2022-08-21 15:15:21 +02:00
2020-09-04 12:46:07 +01:00
2021-06-30 08:47:26 -04:00
2020-08-27 16:06:47 -04:00
2020-10-07 14:28:39 -04:00
2020-05-09 13:57:12 +02:00
2020-07-01 10:49:02 +02:00
2020-07-23 17:34:18 +10:00
2020-05-15 13:51:28 -07:00
2020-08-31 12:52:33 -07:00
2021-03-30 14:32:05 +02:00
2020-10-18 09:27:10 -07:00
2020-05-09 13:57:12 +02:00
2020-08-18 17:06:15 +02:00
2020-08-07 11:33:24 -07:00
2020-09-26 22:55:05 -04:00
2021-05-07 11:04:32 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:31 +02:00
2020-07-04 09:35:36 -05:00
2020-09-10 14:03:31 -07:00
2020-08-01 11:28:17 +02:00
2020-04-01 12:06:26 -04:00
2020-10-05 13:21:49 +02:00