In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/cache: Introduce task_struct->sched_cache_grp to fix UAF<\/p>\n
Add a sched_cache_grp pointer to task_struct so that scheduler code
\ncan access the cache group directly via the task, without going
\nthrough mm->sched_cache_grp. This decouples the scheduler’s hot-path
\naccesses from the mm_struct.<\/p>\n
Each task holds its own refcount on the sched_cache_group, separate
\nfrom the reference held by its mm_struct. The reference is acquired
\nin copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm().
\nThis fixes the use-after-free when account_mm_sched() reaches the group
\nthrough a task whose mm is being switched, as reported by Hyunwoo:<\/p>\n
https:\/\/lore.kernel.org\/lkml\/apPb-Dr4nPYuHQOK@v4bel\/<\/p>\n
Convert all scheduler code in fair.c and exit.c to use
\np->sched_cache_grp instead of p->mm->sched_cache_grp.<\/p>\n
Keep the fork\/exec\/exit reference management out of the generic mm
\npaths: add sched_cache_fork(), sched_cache_fork_cleanup(),
\nsched_cache_exec_mmap() and sched_cache_exit_mm() in
\nkernel\/sched\/cache_sched.c (with empty stubs for !CONFIG_SCHED_CACHE),
\nso fs\/exec.c, kernel\/fork.c and kernel\/exit.c each call one helper
\ninstead of open-coding the refcounting under #ifdef. Also add
\nsched_cache_group_get() and task_cache_group_get().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sched\/cache: Introduce task_struct->sched_cache_grp to fix UAF<\/p>\n
Add a sched_cache_grp pointer to task_struct so that scheduler code<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41338","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}