Files
linux-st/include/linux
Suren Baghdasaryan a06247c680 psi: Fix uaf issue when psi trigger is destroyed while being polled
With write operation on psi files replacing old trigger with a new one,
the lifetime of its waitqueue is totally arbitrary. Overwriting an
existing trigger causes its waitqueue to be freed and pending poll()
will stumble on trigger->event_wait which was destroyed.
Fix this by disallowing to redefine an existing psi trigger. If a write
operation is used on a file descriptor with an already existing psi
trigger, the operation will fail with EBUSY error.
Also bypass a check for psi_disabled in the psi_trigger_destroy as the
flag can be flipped after the trigger is created, leading to a memory
leak.

Fixes: 0e94682b73 ("psi: introduce psi monitor")
Reported-by: syzbot+cdb5dd11c97cc532efad@syzkaller.appspotmail.com
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Analyzed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220111232309.1786347-1-surenb@google.com
2022-01-18 12:09:57 +01:00
..
2022-01-09 10:36:51 -07:00
2021-11-17 10:36:15 -05:00
2021-12-10 17:10:55 -08:00
2021-12-10 12:51:28 +01:00
2021-12-01 00:06:43 +01:00
2021-12-15 15:58:40 +01:00
2022-01-04 13:15:33 -05:00
2021-12-17 09:06:15 +01:00
2021-12-20 09:03:05 +01:00
2022-01-06 12:25:40 +01:00
2021-12-16 22:22:20 +01:00
2022-01-12 10:14:09 -06:00
2021-11-16 19:07:53 -08:00
2021-11-18 09:36:39 +01:00
2021-11-30 17:25:20 -08:00
2021-11-16 13:10:34 +00:00
2021-11-25 18:35:23 +01:00
2021-12-30 12:13:04 +01:00
2021-12-09 10:49:56 -08:00
2022-01-08 00:28:41 -05:00