In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/cache: Decouple sched_cache_group from mm to fix UAF<\/p>\n
Currently the sched cache grouping is by mm and the scheduling statistics
\nsched_cache_stat lives in the mm structure. This ties the life cycle
\nof scheduling stats with mm.<\/p>\n
In account_mm_sched(), the scheduling stats are accessed by
\ntask->mm->sc_stat. However, a task may be switching mm on one CPU when
\nanother CPU is running account_mm_sched(), and possibly accessing the
\nold mm that was freed. This problem was found when running tests with
\nKASAN by Hyunwoo:<\/p>\n
https:\/\/lore.kernel.org\/lkml\/apPb-Dr4nPYuHQOK@v4bel\/<\/p>\n
Instead of serializing the mm access by introducing extra acquisition of
\nrq lock in the mm free path, extract sched_cache_stat from mm_struct,
\nrename it as sched_cache_group and manage its life cycle apart from
\nmm_struct with its own ref counting. This allows us in the next patch
\naccess sched_cache_group directly from task, and add a refcount
\non sched_cache_group when a task links to it. This prevents the use
\nafter free issue when accessing stale and released old mm and its
\nsched cache stat a task switches to a new mm while account_mm_sched()
\nis done elsewhere.<\/p>\n
The other benefit of this restructure is in the future, the grouping of
\ntasks to a LLC would have the flexibility to be associated with a user
\ndefined grouping, or cgroup, cookie group, numa_group or others instead
\nof just with a single mm address space.<\/p>\n
Rename sched_cache_stat to sched_cache_group and turn it into a refcounted
\nobject allocated from mm_struct. The mm_struct now holds a pointer
\n(sched_cache_grp) to this object instead of embedding it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/cache: Decouple sched_cache_group from mm to fix UAF<\/p>\n
Currently the sched cache grouping is by mm and the scheduling statisti<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-35936","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/35936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=35936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=35936"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=35936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}