lkml.org 
[lkml]   [2023]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: cgroup user-after-free
On Wed, Feb 01, 2023 at 06:04:04AM +0000, Lixiong Liu (刘利雄) wrote:
> On Fri, 2023-01-13 at 13:40 +0800, lixiong liu wrote:
> > > > Root cause:
> > > > cgroup_migrate_finish free cset’s cgroup,
> > > >
> > > > but cgroup_sk_alloc use the freed cgroup,
> > > >
> > > > then use-after-free happened.
> > >
> > > Sounds similar to the problem fixed by 07fd5b6cdf3c ("cgroup: Use
> > > separate
> > > src/dst nodes when preloading css_sets for migration"). Can you try
> > > it out?
> > >
> > > Thanks.
> > >
> >
> >
> > Thanks for your quick feedback.
> >
> >
> >
> > But we encountered use-after-free version
> >
> > already contains this patch.
> >
> >
> >
> > So, with this patch will also encounter
> >
> > this use-after-free.
> >
> > Thanks!
> >
> >
> Do you have any suggestion for this issue?

Unfortunately, there isn't a lot to latch onto. It's on an older kernel and
there's no reproducer. Refcnting in the path is tricky and it wouldn't be
too surprising for some bugs to be there. If you can repro on a recent
kernel, that'd help a lot.

Thanks.

--
tejun

\
 
 \ /
  Last update: 2023-03-27 00:08    [W:0.086 / U:1.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site