github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

cgroup: Fixes for v7.3-rc3

Browse Source 
- The task iterator could pick up a dying task whose refcount had already
   dropped to zero and resurrect it, leading to a use-after-free when
   reading cgroup.procs. Skip such tasks.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCaql+xg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGVcaAP424sQDRkkInl7APgUeQfgUheNG8WgCUt+qMgT2
 6VbVEwD9HodEyKW4r/JBWcqN3m4bbNSx57gpXgQwH+ESoorqLgs=
 =nZ8D
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fix from Tejun Heo:

 - The task iterator could pick up a dying task whose refcount had
   already dropped to zero and resurrect it, leading to a use-after-free
   when reading cgroup.procs. Skip such tasks.

* tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: Avoid iteration of dying tasks with zero refcount
This commit is contained in:
Linus Torvalds 2026-09-15 11:40:30 -07:00
commit 6fb20c0271
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
kernel/cgroup/cgroup.c
View File

@ -5303,10 +5303,13 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
if (it->flags & CSS_TASK_ITER_SKIPPED)
css_task_iter_advance(it);
if (it->task_pos) {
while (it->task_pos && !it->cur_task) {
it->cur_task = list_entry(it->task_pos, struct task_struct,
cg_list);
get_task_struct(it->cur_task);
/* a task on dying_tasks with zero refcount is only valid for
* RCU readers, not even interesting for
* CSS_TASK_ITER_WITH_DEAD, find another one */
it->cur_task = tryget_task_struct(it->cur_task);
css_task_iter_advance(it);
}