From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3859C05027 for ; Thu, 2 Feb 2023 21:11:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 61E896B0073; Thu, 2 Feb 2023 16:11:50 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 5CE0D6B0074; Thu, 2 Feb 2023 16:11:50 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 496AF6B0075; Thu, 2 Feb 2023 16:11:50 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 3D0916B0073 for ; Thu, 2 Feb 2023 16:11:50 -0500 (EST) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 0B1A91A0FBE for ; Thu, 2 Feb 2023 21:11:50 +0000 (UTC) X-FDA: 80423598780.10.6AD3221 Received: from mail-yb1-f178.google.com (mail-yb1-f178.google.com [209.85.219.178]) by imf02.hostedemail.com (Postfix) with ESMTP id 5BDD28001B for ; Thu, 2 Feb 2023 21:11:48 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=CnXXTWGb; spf=pass (imf02.hostedemail.com: domain of surenb@google.com designates 209.85.219.178 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1675372308; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=j+CqMtFrVSGkYiD3673aMvxsTntB2I4HLVlj0tiHNNI=; b=xnOIClECn4f7oRugt8WAR8Cru+IwbLNNizDrVSXYB4eaL8IyFpJu9cv3DrgENXP4fEXGZ1 tobAzbeyW0G8OINfb5cW5tyKrnJFVNgLsV2Vcp3RYErtqs8H8bSHPfWnXRR9aVREthS+0a XUCpD4tCMpTprouunFR66dIZgz6QHZ4= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=CnXXTWGb; spf=pass (imf02.hostedemail.com: domain of surenb@google.com designates 209.85.219.178 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1675372308; a=rsa-sha256; cv=none; b=kd9cgiJJxbJCoRZWbck3j88vKWHHE5X9g0I/MJCtuh5w5ZlyouvlukyoNUzqymczM7RQVA fH1QLqj5CapWnauTIXpY78WlClyVOvWd40hcxlAW75dThC0qXrbrDM/AlVFYRKzHHTvnTE kCwvsHMhvBKt+EZ9PqG5Hh6C+gljHWo= Received: by mail-yb1-f178.google.com with SMTP id 129so3978373ybb.0 for ; Thu, 02 Feb 2023 13:11:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=j+CqMtFrVSGkYiD3673aMvxsTntB2I4HLVlj0tiHNNI=; b=CnXXTWGbi5MfdiGnHvkf0MWLYlJ/KDP9fWsDIjlvZ8/zcosRgAlSxNOwf3hzUd0Ky/ EE8s0lpWmM5P0/d4HqZs6wpEXwUpLd2hgQ97yZRHONrj2x3FiI7c3nXdrndTKbp0xq+S sllzBBNnXErmDfXPo1Dub1ZTMsPWgoHAk98QPByIyPrd7SBFtorjpFkKXgOZ3/QMH75z NFQ5nbbqcotZid+T1RaUMDRM7HQqEiHaTtLRE2+70QbdyHSLN0xThX06XWXu55efO/7a kQVySGOuMwbRMu3SfC+SqQBiJiLCM/sJyKEOCKrwjGUwS/Rdx7feRXMYgLvweeBxZiPt pbaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=j+CqMtFrVSGkYiD3673aMvxsTntB2I4HLVlj0tiHNNI=; b=rWqOZAVGN51MNrXIAe5pKav5X7/uEjeevyn4EYsOBqa6u+3pQrmqtlhtnze0KgwZGv 5lruOyMplf60gDyXqDbpCYVSd3MLRMcqpnLNIN7LM6gWxZpa/Xfj5HdC9DgyxEESTPoV 3Bj8ZlrfkL0VJ/7N3rssPW346LkYXeq0nrNjVvZVSWCtupe83+9nMfoqbmFDtLwjeau8 3pCj8Psmu2VFee/2Yz+v2PgyEzQbqYhirbU/+a+5hWWDgtLsTuQe3uPnCTQ2x55kUV4A sbOa73KGsnR9Ar0nbZeI7mPSR2u9JUXL44vM4JFcrHOLFj1t6u4gyH0rL9XxN1SnS35p k0Ww== X-Gm-Message-State: AO0yUKWAe67vt1yFXBl8TVUM+l1jg9bkdVS+skkJ/tB2TGaqo3ksEG2Q fAO/WSh1A4krda1fItRZhQUTOr7V9RCoDmYp7zXbbw== X-Google-Smtp-Source: AK7set8dW/3ELqgHnqlRkiGKJao9L8VMiVvIhM/4TdKtluEAMjhR7nAYm8zA9yi2w+T372MxrWk7KDkhWrmxtayFHUM= X-Received: by 2002:a25:5007:0:b0:80f:4da9:d5dc with SMTP id e7-20020a255007000000b0080f4da9d5dcmr846491ybb.431.1675372307335; Thu, 02 Feb 2023 13:11:47 -0800 (PST) MIME-Version: 1.0 References: <20230202030023.1847084-1-kamatam@amazon.com> In-Reply-To: From: Suren Baghdasaryan Date: Thu, 2 Feb 2023 13:11:36 -0800 Message-ID: Subject: Re: [PATCH] sched/psi: fix use-after-free in ep_remove_wait_queue() To: Eric Biggers Cc: Munehisa Kamata , hannes@cmpxchg.org, hdanton@sina.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, mengcc@amazon.com, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: kuir4t8rkhuttec4nek75fhzg9gp4wpb X-Rspam-User: X-Rspamd-Queue-Id: 5BDD28001B X-Rspamd-Server: rspam06 X-HE-Tag: 1675372308-666247 X-HE-Meta: U2FsdGVkX1+HxhS2MnjAyuFxT/E+/NxHzNA1DVr9zUhCZxSDL+5p1ahUWcWHo4nRNixc6NfI0rTfOl8dXN0Ii3+zpGhOno1gTSEFEh06SwD2cZz5y2vXG4Zupn21TrclUOY0C8Wl9wYWso/Dn/dgBnaSRrtUNDUPH58sdd5In/bAHrcXugfJPM0uC0XOaMOAuShwknHy5NGHk+zXAbbAnPYpR6B7nk+Bz9ydYHsWyoriWz8sVza01pLC2Q008lR2OqFCvZViHhcu4bnXIQeSNBsSFimu/AlKq07u47eUSv+ERw/mE9KzYA0f5nu6R/jzuWN+epU7gX4hbSEGNbxfuECkk6uO0H88sgZkcfQ8Yb74J3p6tS8N3JrNgfSFeJ9yhdTHZBvi1vsxgMV/1TLTP8MU3QrPdckWN/j7M63W6rAf1lB05UoHoBzcXHOp9cNIpOl0NONiRZX6VwKhF8Lo2YsAtTOSH1iKD9KlDNH9ShE4SLTujweQ3XToCaruTtYEKniAD75omLqp8dApRyNMMcawfB6Ll3OTGvVt2EuVup6Nb6tsywriBYll8ds7d33sGgNrPRMZy9Pk7+3N3pxNuZRzlxlNavmMZAeCY8eSeYuaIx0YSPYh+Jc9MdW1WB+bqq2r+niro4oNHuPkA/eI4c1GUbstdBlQPXT2H14PzkT8OpRfM1WkwA56EUpgyobEyZxyKPc15D3Pu/OtIDWUaM0d9WpvMlEGhU6625pkMYjnsZ1sc+/mI0BTdvzxmPZ0k2qh3SEHv+IsByxXgYLmExFwwnpwN81DNr/zhI4wrd2JEpPGo5oDBQA9zpGBXiSimZMyb4urvzaaarkJNIfFOYAkNW6lmehN56OJ0DAwPEoqdSHQ9oOwfWwlSb/q0l6Rs+olDflvrDv0ckTe2xHEPNtkEjbIzse4CWalmc0nB24gqFNWvJ0QTdWEH7KSb+uxybaFkdboIL1SDq908Rk YR6KgfxQ sOke7r5W8MJ9AS9UeNF08tf3pwV14UBajTX6ZYLXRW89s/qBX9NSmRg18F0jSmQXOsedlbg17rSzasi0CKXCnf07Dm2U23WXAqZi97jdEby8COcdICnIxAEW0FUkYS1yeUViEuQvWRgnfOm95jY4AmCMg5Zqh6n8OpHCYFNqS4EsUjC1TeRihETREw/pyX7T8FE5ZHmtZPTCf9j+zDpXaeMS0l5uG93w0gm+qIWRhKyJEdgyK/lx1AiRs8CtM3jowAfl7Q87w74D7quRNKnahWNThyVxwvOg9toJ7C+kKzT3qaMqhCasVJDEo9Jj548njpesSN2twGTm2P8T8gtyzAvPR8KEX662U1hS+//s3ixTN8tAn+DIm3mja4g== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Feb 1, 2023 at 8:56 PM Eric Biggers wrote: > > On Wed, Feb 01, 2023 at 07:00:23PM -0800, Munehisa Kamata wrote: > > diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c > > index 8ac8b81bfee6..6e66c15f6450 100644 > > --- a/kernel/sched/psi.c > > +++ b/kernel/sched/psi.c > > @@ -1343,10 +1343,11 @@ void psi_trigger_destroy(struct psi_trigger *t) > > > > group = t->group; > > /* > > - * Wakeup waiters to stop polling. Can happen if cgroup is deleted > > - * from under a polling process. > > + * Wakeup waiters to stop polling and clear the queue to prevent it from > > + * being accessed later. Can happen if cgroup is deleted from under a > > + * polling process otherwise. > > */ > > - wake_up_interruptible(&t->event_wait); > > + wake_up_pollfree(&t->event_wait); > > > > mutex_lock(&group->trigger_lock); > > wake_up_pollfree() should only be used in extremely rare cases. Why can't the > lifetime of the waitqueue be fixed instead? waitqueue lifetime in this case is linked to cgroup_file_release(), which seems appropriate to me here. Unfortunately cgroup_file_release() is not directly linked to the file's lifetime. For more details see: https://lore.kernel.org/all/CAJuCfpFZ3B4530TgsSHqp5F_gwfrDujwRYewKReJru==MdEHQg@mail.gmail.com/#t . So, if we want to fix the lifetime of the waitqueue, we would have to tie cgroup_file_release() to the fput() somehow. IOW, the fix would have to be done at the cgroups or higher (kernfs?) layer. Thanks, Suren. > > - Eric