mirror of
https://github.com/torvalds/linux.git
synced 2026-10-04 18:29:02 +02:00
5a88f78df7
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.
kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().
At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.
Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.
Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level
kernel/pid.c:556 pid_vnr() # calls pid_nr_ns()
kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
Fixes:
|
||
|---|---|---|
| .. | ||
| .gitignore | ||
| .kunitconfig | ||
| calibrate.c | ||
| do_mounts_initrd.c | ||
| do_mounts_rd.c | ||
| do_mounts.c | ||
| do_mounts.h | ||
| init_task.c | ||
| initramfs_internal.h | ||
| initramfs_test.c | ||
| initramfs.c | ||
| Kconfig | ||
| main.c | ||
| Makefile | ||
| noinitramfs.c | ||
| version-timestamp.c | ||
| version.c | ||