Commit 6bd9ed02 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'cgroup-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 

Pull cgroup fixes from Tejun Heo:
 "Three dmem fixes from Chen Ridong addressing use-after-free, RCU
  warning, and NULL pointer dereference issues introduced with the dmem
  controller.

  All changes are confined to kernel/cgroup/dmem.c and can only affect
  dmem controller users"

* tag 'cgroup-for-6.19-rc8-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup/dmem: avoid pool UAF
  cgroup/dmem: avoid rcu warning when unregister region
  cgroup/dmem: fix NULL pointer dereference when setting max
parents dee65f79 99a2ef50

kernel/cgroup/dmem.c

+63 −7
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <linux/mutex.h>

#include <linux/page_counter.h>

#include <linux/parser.h>

#include <linux/refcount.h>

#include <linux/rculist.h>

#include <linux/slab.h>
@@ -71,7 +72,9 @@ struct dmem_cgroup_pool_state { 
	struct rcu_head rcu;



	struct page_counter cnt;

	struct dmem_cgroup_pool_state *parent;



	refcount_t ref;

	bool inited;

};
@@ -88,6 +91,9 @@ struct dmem_cgroup_pool_state { 
static DEFINE_SPINLOCK(dmemcg_lock);

static LIST_HEAD(dmem_cgroup_regions);



static void dmemcg_free_region(struct kref *ref);

static void dmemcg_pool_free_rcu(struct rcu_head *rcu);



static inline struct dmemcg_state *

css_to_dmemcs(struct cgroup_subsys_state *css)

{
@@ -104,10 +110,38 @@ static struct dmemcg_state *parent_dmemcs(struct dmemcg_state *cg) 
	return cg->css.parent ? css_to_dmemcs(cg->css.parent) : NULL;

}



static void dmemcg_pool_get(struct dmem_cgroup_pool_state *pool)

{

	refcount_inc(&pool->ref);

}



static bool dmemcg_pool_tryget(struct dmem_cgroup_pool_state *pool)

{

	return refcount_inc_not_zero(&pool->ref);

}



static void dmemcg_pool_put(struct dmem_cgroup_pool_state *pool)

{

	if (!refcount_dec_and_test(&pool->ref))

		return;



	call_rcu(&pool->rcu, dmemcg_pool_free_rcu);

}



static void dmemcg_pool_free_rcu(struct rcu_head *rcu)

{

	struct dmem_cgroup_pool_state *pool = container_of(rcu, typeof(*pool), rcu);



	if (pool->parent)

		dmemcg_pool_put(pool->parent);

	kref_put(&pool->region->ref, dmemcg_free_region);

	kfree(pool);

}



static void free_cg_pool(struct dmem_cgroup_pool_state *pool)

{

	list_del(&pool->region_node);

	kfree(pool);

	dmemcg_pool_put(pool);

}



static void
@@ -342,6 +376,12 @@ alloc_pool_single(struct dmemcg_state *dmemcs, struct dmem_cgroup_region *region 
	page_counter_init(&pool->cnt,

			  ppool ? &ppool->cnt : NULL, true);

	reset_all_resource_limits(pool);

	refcount_set(&pool->ref, 1);

	kref_get(&region->ref);

	if (ppool && !pool->parent) {

		pool->parent = ppool;

		dmemcg_pool_get(ppool);

	}



	list_add_tail_rcu(&pool->css_node, &dmemcs->pools);

	list_add_tail(&pool->region_node, &region->pools);
@@ -389,6 +429,10 @@ get_cg_pool_locked(struct dmemcg_state *dmemcs, struct dmem_cgroup_region *regio 


		/* Fix up parent links, mark as inited. */

		pool->cnt.parent = &ppool->cnt;

		if (ppool && !pool->parent) {

			pool->parent = ppool;

			dmemcg_pool_get(ppool);

		}

		pool->inited = true;



		pool = ppool;
@@ -423,7 +467,7 @@ static void dmemcg_free_region(struct kref *ref) 
 */

void dmem_cgroup_unregister_region(struct dmem_cgroup_region *region)

{

	struct list_head *entry;

	struct dmem_cgroup_pool_state *pool, *next;



	if (!region)

		return;
@@ -433,11 +477,10 @@ void dmem_cgroup_unregister_region(struct dmem_cgroup_region *region) 
	/* Remove from global region list */

	list_del_rcu(&region->region_node);



	list_for_each_rcu(entry, &region->pools) {

		struct dmem_cgroup_pool_state *pool =

			container_of(entry, typeof(*pool), region_node);



	list_for_each_entry_safe(pool, next, &region->pools, region_node) {

		list_del_rcu(&pool->css_node);

		list_del(&pool->region_node);

		dmemcg_pool_put(pool);

	}



	/*
@@ -518,8 +561,10 @@ static struct dmem_cgroup_region *dmemcg_get_region_by_name(const char *name) 
 */

void dmem_cgroup_pool_state_put(struct dmem_cgroup_pool_state *pool)

{

	if (pool)

	if (pool) {

		css_put(&pool->cs->css);

		dmemcg_pool_put(pool);

	}

}

EXPORT_SYMBOL_GPL(dmem_cgroup_pool_state_put);
@@ -533,6 +578,8 @@ get_cg_pool_unlocked(struct dmemcg_state *cg, struct dmem_cgroup_region *region) 
	pool = find_cg_pool_locked(cg, region);

	if (pool && !READ_ONCE(pool->inited))

		pool = NULL;

	if (pool && !dmemcg_pool_tryget(pool))

		pool = NULL;

	rcu_read_unlock();



	while (!pool) {
@@ -541,6 +588,8 @@ get_cg_pool_unlocked(struct dmemcg_state *cg, struct dmem_cgroup_region *region) 
			pool = get_cg_pool_locked(cg, region, &allocpool);

		else

			pool = ERR_PTR(-ENODEV);

		if (!IS_ERR(pool))

			dmemcg_pool_get(pool);

		spin_unlock(&dmemcg_lock);



		if (pool == ERR_PTR(-ENOMEM)) {
@@ -576,6 +625,7 @@ void dmem_cgroup_uncharge(struct dmem_cgroup_pool_state *pool, u64 size) 


	page_counter_uncharge(&pool->cnt, size);

	css_put(&pool->cs->css);

	dmemcg_pool_put(pool);

}

EXPORT_SYMBOL_GPL(dmem_cgroup_uncharge);
@@ -627,7 +677,9 @@ int dmem_cgroup_try_charge(struct dmem_cgroup_region *region, u64 size, 
		if (ret_limit_pool) {

			*ret_limit_pool = container_of(fail, struct dmem_cgroup_pool_state, cnt);

			css_get(&(*ret_limit_pool)->cs->css);

			dmemcg_pool_get(*ret_limit_pool);

		}

		dmemcg_pool_put(pool);

		ret = -EAGAIN;

		goto err;

	}
@@ -700,6 +752,9 @@ static ssize_t dmemcg_limit_write(struct kernfs_open_file *of, 
		if (!region_name[0])

			continue;



		if (!options || !*options)

			return -EINVAL;



		rcu_read_lock();

		region = dmemcg_get_region_by_name(region_name);

		rcu_read_unlock();
@@ -719,6 +774,7 @@ static ssize_t dmemcg_limit_write(struct kernfs_open_file *of, 


		/* And commit */

		apply(pool, new_limit);

		dmemcg_pool_put(pool);



out_put:

		kref_put(&region->ref, dmemcg_free_region);