LinuxLists.cc - [PATCH] cgroup: fix psi_show() crash on 32bit ino archs

2020-02-24 03:01:20

Subject: [PATCH] cgroup: fix psi_show() crash on 32bit ino archs

Similar to the commit d7495343228f ("cgroup: fix incorrect
WARN_ON_ONCE() in cgroup_setup_root()"), cgroup_id(root_cgrp) does not
equal to 1 on 32bit ino archs which triggers all sorts of issues with
psi_show() on s390x. For example,

BUG: KASAN: slab-out-of-bounds in collect_percpu_times+0x2d0/
Read of size 4 at addr 000000001e0ce000 by task read_all/3667
collect_percpu_times+0x2d0/0x798
psi_show+0x7c/0x2a8
seq_read+0x2ac/0x830
vfs_read+0x92/0x150
ksys_read+0xe2/0x188
system_call+0xd8/0x2b4

Fix it by using cgroup_ino().

Fixes: 743210386c03 ("cgroup: use cgrp->kn->id as the cgroup ID")
Signed-off-by: Qian Cai <[email protected]>
---
kernel/cgroup/cgroup.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 75f687301bbf..cd5f41289f7d 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -3542,21 +3542,21 @@ static int cpu_stat_show(struct seq_file *seq, void *v)
static int cgroup_io_pressure_show(struct seq_file *seq, void *v)
{
struct cgroup *cgrp = seq_css(seq)->cgroup;
- struct psi_group *psi = cgroup_id(cgrp) == 1 ? &psi_system : &cgrp->psi;
+ struct psi_group *psi = cgroup_ino(cgrp) == 1 ? &psi_system : &cgrp->psi;

return psi_show(seq, psi, PSI_IO);
}
static int cgroup_memory_pressure_show(struct seq_file *seq, void *v)
{
struct cgroup *cgrp = seq_css(seq)->cgroup;
- struct psi_group *psi = cgroup_id(cgrp) == 1 ? &psi_system : &cgrp->psi;
+ struct psi_group *psi = cgroup_ino(cgrp) == 1 ? &psi_system : &cgrp->psi;

return psi_show(seq, psi, PSI_MEM);
}
static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v)
{
struct cgroup *cgrp = seq_css(seq)->cgroup;
- struct psi_group *psi = cgroup_id(cgrp) == 1 ? &psi_system : &cgrp->psi;
+ struct psi_group *psi = cgroup_ino(cgrp) == 1 ? &psi_system : &cgrp->psi;

return psi_show(seq, psi, PSI_CPU);
}
--
2.21.0 (Apple Git-122.2)

2020-02-24 16:30:30

by Johannes Weiner

[permalink] [raw]

Subject: Re: [PATCH] cgroup: fix psi_show() crash on 32bit ino archs

On Sun, Feb 23, 2020 at 10:00:07PM -0500, Qian Cai wrote:
> Similar to the commit d7495343228f ("cgroup: fix incorrect
> WARN_ON_ONCE() in cgroup_setup_root()"), cgroup_id(root_cgrp) does not
> equal to 1 on 32bit ino archs which triggers all sorts of issues with
> psi_show() on s390x. For example,
>
> BUG: KASAN: slab-out-of-bounds in collect_percpu_times+0x2d0/
> Read of size 4 at addr 000000001e0ce000 by task read_all/3667
> collect_percpu_times+0x2d0/0x798
> psi_show+0x7c/0x2a8
> seq_read+0x2ac/0x830
> vfs_read+0x92/0x150
> ksys_read+0xe2/0x188
> system_call+0xd8/0x2b4
>
> Fix it by using cgroup_ino().
>
> Fixes: 743210386c03 ("cgroup: use cgrp->kn->id as the cgroup ID")
> Signed-off-by: Qian Cai <[email protected]>

Acked-by: Johannes Weiner <[email protected]>

2020-03-04 13:37:12

by Qian Cai

[permalink] [raw]

Subject: Re: [PATCH] cgroup: fix psi_show() crash on 32bit ino archs

On Mon, 2020-02-24 at 11:29 -0500, Johannes Weiner wrote:
> On Sun, Feb 23, 2020 at 10:00:07PM -0500, Qian Cai wrote:
> > Similar to the commit d7495343228f ("cgroup: fix incorrect
> > WARN_ON_ONCE() in cgroup_setup_root()"), cgroup_id(root_cgrp) does not
> > equal to 1 on 32bit ino archs which triggers all sorts of issues with
> > psi_show() on s390x. For example,
> >
> > BUG: KASAN: slab-out-of-bounds in collect_percpu_times+0x2d0/
> > Read of size 4 at addr 000000001e0ce000 by task read_all/3667
> > collect_percpu_times+0x2d0/0x798
> > psi_show+0x7c/0x2a8
> > seq_read+0x2ac/0x830
> > vfs_read+0x92/0x150
> > ksys_read+0xe2/0x188
> > system_call+0xd8/0x2b4
> >
> > Fix it by using cgroup_ino().
> >
> > Fixes: 743210386c03 ("cgroup: use cgrp->kn->id as the cgroup ID")
> > Signed-off-by: Qian Cai <[email protected]>
>
> Acked-by: Johannes Weiner <[email protected]>

Tejun, can you take a look at this when you had a chance?

2020-03-04 16:17:00

by Tejun Heo

[permalink] [raw]