lkml.org 
[lkml]   [2022]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] cgroup: handle cset multiidentity issue when migration
Hello.

On Thu, Jun 09, 2022 at 11:49:38AM +0800, 史思远 <shisiyuan19870131@gmail.com> wrote:
> The process is like above photo, thread 2 exits
> between cgroup_migrate_prepare_dst() and cgroup_migrate_execute().
> Then the refcount of csetX turns to be 0 here, and UAF appears when thread1
> migrating.
> Thread2 exits asynchronously, can rwsem prevent it?

See the bailout in cgroup_migrate_add_task():

if (task->flags & PF_EXITING)
return;

And cgroup_threadgroup_change_begin(tsk) in exit_signals().

> The purpose of my patch is to keep csetX's refcount still 1 after thread2
> exits, and make sure thread1 migrating successfully.

Why is not src_cset==dst_cset in cgroup_migrate_prepare_dst() not
sufficient?

Still, can this be reproduced in real world or is your reasoning based
on theory only?

Thanks,
Michal

\
 
 \ /
  Last update: 2022-06-09 12:02    [W:0.095 / U:0.416 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site