FAILED: patch "[PATCH] reboot: fix cad_pid use-after-free race" failed to apply to 6.6-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 5a88f78df753993469dab4d1831f8fb4256a9468
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091654-satiable-demanding-819a@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5a88f78df753993469dab4d1831f8fb4256a9468 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft)" <[email protected]>
Date: Fri, 14 Aug 2026 00:09:44 -0400
Subject: [PATCH] reboot: fix cad_pid use-after-free race
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free.
kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid().
At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race.
Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list.
Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
include/linux/sched.h +1 -1
@@ -1778,7 +1778,7 @@ static inline bool is_lazy_mmu_mode_active(void) }#endif -extern struct pid *cad_pid; +extern struct pid __rcu *cad_pid;/* * Per process flags
include/linux/sched/signal.h +1 -4
@@ -562,10 +562,7 @@ static inline sigset_t *sigmask_to_save(void)return res; } -static inline int kill_cad_pid (int sig,int priv) -{ -return kill_pid (cad_pid, sig, priv); -} +int kill_cad_pid (int sig,int priv);/* These can be the second arg to send_sig_info/send_group_sig_info. */ #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)
init/main.c +1 -1
@@ -1644,7 +1644,7 @@ static noinline void __init kernel_init_freeable(void)*/ set_mems_allowed (node_states[N_MEMORY ]); - cad_pid =get_pid (task_pid (current)); +rcu_assign_pointer (cad_pid,get_pid (task_pid (current)));smp_prepare_cpus (setup_max_cpus);
kernel/reboot.c +15 -4
@@ -13,7 +13,9 @@#include <linux/kexec.h> #include <linux/kmod.h> #include <linux/kmsg_dump.h> +#include <linux/rcupdate.h> #include <linux/reboot.h> +#include <linux/sched/signal.h> #include <linux/suspend.h> #include <linux/syscalls.h> #include <linux/syscore_ops.h>
@@ -24,8 +26,7 @@*/ static int C_A_D =1 ; -struct pid *cad_pid; -EXPORT_SYMBOL (cad_pid); +struct pid __rcu *cad_pid;#if defined(CONFIG_ARM )#define DEFAULT_REBOOT_MODE = REBOOT_HARD
@@ -1371,10 +1372,14 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe {struct ctl_table tmp_table = *table;struct pid *new_pid; +struct pid *old_pid;pid_t tmp_pid;int r; - tmp_pid =pid_vnr (cad_pid); +rcu_read_lock (); + tmp_pid =pid_vnr (rcu_dereference (cad_pid)); +rcu_read_unlock (); + tmp_table.data = &tmp_pid; r =proc_dointvec (&tmp_table, write, buffer, lenp, ppos);
@@ -1385,7 +1390,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffeif (!new_pid)return -ESRCH ; -put_pid (xchg (&cad_pid, new_pid)); + old_pid =unrcu_pointer (xchg (&cad_pid,RCU_INITIALIZER (new_pid))); +/* +* Wait for cad_pid readers before put_pid(). We cannot use +* call_rcu() here because free_pid() already owns pid->rcu. +*/ +synchronize_rcu (); +put_pid (old_pid);return 0 ; }
kernel/signal.c +12 -0
@@ -1899,6 +1899,18 @@ int kill_pid(struct pid *pid, int sig, int priv) }EXPORT_SYMBOL (kill_pid); +int kill_cad_pid (int sig,int priv) +{ +int ret; + +rcu_read_lock (); + ret =kill_pid (rcu_dereference (cad_pid), sig, priv); +rcu_read_unlock (); + +return ret; +} +EXPORT_SYMBOL (kill_cad_pid); +#ifdef CONFIG_POSIX_TIMERS /* * These functions handle POSIX timer signals. POSIX timers use
Sasha Levin
maintainerPATCH 1/3 mm: clarify lazy_mmu sleeping constraints
From: Kevin Brodsky <[email protected]>
[ Upstream commit f2be745071ffd6793c032ca8443348c3ce0e3e18 ]
The lazy MMU mode documentation makes clear that an implementation should not assume that preemption is disabled or any lock is held upon entry to the mode; however it says nothing about what code using the lazy MMU interface should expect.
In practice sleeping is forbidden (for generic code) while the lazy MMU mode is active: say it explicitly.
Stable-dep-of: 5a88f78df753 ("reboot: fix cad_pid use-after-free race")
--- include/linux/pgtable.h | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
include/linux/pgtable.h +9 -5
@@ -197,11 +197,15 @@ static inline int pmd_young(pmd_t pmd)* up to date. * * In the general case, no lock is guaranteed to be held between entry and exit -* of the lazy mode. So the implementation must assume preemption may be enabled -* and cpu migration is possible; it must take steps to be robust against this. -* (In practice, for user PTE updates, the appropriate page table lock(s) are -* held, but for kernel PTE updates, no lock is held). Nesting is not permitted -* and the mode cannot be used in interrupt context. +* of the lazy mode. (In practice, for user PTE updates, the appropriate page +* table lock(s) are held, but for kernel PTE updates, no lock is held). +* The implementation must therefore assume preemption may be enabled upon +* entry to the mode and cpu migration is possible; it must take steps to be +* robust against this. An implementation may handle this by disabling +* preemption, as a consequence generic code may not sleep while the lazy MMU +* mode is active. +* +* Nesting is not permitted and the mode cannot be used in interrupt context. */ #ifndef __HAVE_ARCH_ENTER_LAZY_MMU_MODE#define arch_enter_lazy_mmu_mode () do {} while (0)
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
From: Oleg Nesterov <[email protected]>
[ Upstream commit 7170ca01623b399c97f2ae9d3e228badc1f25ea3 ]
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
Stable dependency adaptation for 6.6:
The cad_pid handler and entry still live in kernel/sysctl.c here, and the namespaced pid_table does not exist. Move the existing handler and entry directly into kernel/reboot.c, leaving kernel/pid.c unchanged. The namespace permission bug described above is absent in this tree; this relocation prepares the cad_pid lifetime fix in 5a88f78df753.
Use a temporary ctl_table and proc_dointvec() instead of the private __do_proc_dointvec(), retaining the non-const handler signature, mutable table and sentinel required by 6.6. Register the reboot sysctls from their existing initializer as an independent late initcall so cad_pid remains available with CONFIG_SYSFS disabled.
Guard the existing POSIX timer sigqueue helpers with CONFIG_POSIX_TIMERS and align their introductory comment with the target's insertion context. Separate the cad_pid declaration from is_global_init() with a descriptive comment and a blank line so the target's declaration change merges without importing the newer lazy-MMU helpers. No new functions are introduced.
[ sashal: Reduced backport -- upstream 7170ca01623b3 touches 2 file(s), this
backport carries 4. Not backported here:
kernel/pid.c
This note is generated from the file lists only; see the resolution record for the reasoning. ]
Stable-dep-of: 5a88f78df753 ("reboot: fix cad_pid use-after-free race")
--- include/linux/sched.h | 2 ++ kernel/reboot.c | 39 ++++++++++++++++++++++++++++++++++----- kernel/signal.c | 12 ++++++++---- kernel/sysctl.c | 31 ------------------------------- 4 files changed, 44 insertions(+), 40 deletions(-)
include/linux/sched.h +2 -0
@@ -1739,6 +1739,8 @@ static inline int is_global_init(struct task_struct *tsk)return task_tgid_nr (tsk) ==1 ; } +/* PID to notify when Ctrl-Alt-Del sends a signal. */ +extern struct pid *cad_pid;/*
kernel/reboot.c +34 -5
@@ -1256,8 +1256,32 @@ static struct attribute *reboot_attrs[] = {#endif NULL, }; +#endif /* CONFIG_SYSFS */ #ifdef CONFIG_SYSCTL +static int proc_do_cad_pid(struct ctl_table *table, int write, void *buffer, + size_t *lenp, loff_t *ppos) +{ + struct ctl_table tmp_table = *table; + struct pid *new_pid; + pid_t tmp_pid; + int r; + + tmp_pid = pid_vnr(cad_pid); + tmp_table.data = &tmp_pid; + + r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); + if (r || !write) + return r; + + new_pid = find_get_pid(tmp_pid); + if (!new_pid) + return -ESRCH; + + put_pid(xchg(&cad_pid, new_pid)); + return 0; +} + static struct ctl_table kern_reboot_table[] = { { .procname = "poweroff_cmd",
@@ -1273,17 +1297,24 @@ static struct ctl_table kern_reboot_table[] = { .mode = 0644, .proc_handler = proc_dointvec, }, + { + .procname = "cad_pid", + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_do_cad_pid, + }, { } }; -static void __init kernel_reboot_sysctls_init (void ) +static int __init kernel_reboot_sysctls_init (void ) {register_sysctl_init ("kernel" , kern_reboot_table); +return 0 ; } -#else -#define kernel_reboot_sysctls_init () do { } while (0) +late_initcall (kernel_reboot_sysctls_init);#endif /* CONFIG_SYSCTL */ +#ifdef CONFIG_SYSFS static const struct attribute_group reboot_attr_group = { .attrs = reboot_attrs, };
@@ -1303,8 +1334,6 @@ static int __init reboot_ksysfs_init(void)return ret; } -kernel_reboot_sysctls_init (); -return 0 ; }late_initcall (reboot_ksysfs_init);
kernel/signal.c +8 -4
@@ -1950,11 +1950,13 @@ int kill_pid(struct pid *pid, int sig, int priv) }EXPORT_SYMBOL (kill_pid); +#ifdef CONFIG_POSIX_TIMERS /* -* These functions support sending signals using preallocated sigqueue -* structures. This is needed "because realtime applications cannot -* afford to lose notifications of asynchronous events, like timer -* expirations or I/O completions". In the case of POSIX Timers +* These functions handle POSIX timer signals. POSIX timers use +* preallocated sigqueue structs for sending signals. This is needed +* "because realtime applications cannot afford to lose notifications of +* asynchronous events, like timer expirations or I/O completions". +* In the case of POSIX Timers * we allocate the sigqueue structure from the timer_create. If this * allocation fails we are able to report the failure to the application * with an EAGAIN error.
@@ -2054,6 +2056,8 @@ int send_sigqueue(struct sigqueue *q, struct pid *pid, enum pid_type type) return ret; } +#endif /* CONFIG_POSIX_TIMERS */ +static void do_notify_pidfd (struct task_struct *task) {struct pid *pid;
kernel/sysctl.c +0 -31
@@ -1327,28 +1327,6 @@ int proc_dointvec_ms_jiffies(struct ctl_table *table, int write, void *buffer, do_proc_dointvec_ms_jiffies_conv, NULL); } -static int proc_do_cad_pid (struct ctl_table *table,int write,void *buffer, -size_t *lenp,loff_t *ppos) -{ -struct pid *new_pid; -pid_t tmp; -int r; - - tmp =pid_vnr (cad_pid); - - r =__do_proc_dointvec (&tmp, table, write, buffer, - lenp, ppos,NULL ,NULL ); -if (r || !write) -return r; - - new_pid =find_get_pid (tmp); -if (!new_pid) -return -ESRCH ; - -put_pid (xchg (&cad_pid, new_pid)); -return 0 ; -} -/** * proc_do_large_bitmap - read/write from/to a large bitmap * @table: the sysctl table
@@ -1765,15 +1743,6 @@ static struct ctl_table kern_table[] = { .mode = 0644, .proc_handler = sysrq_sysctl_handler, }, -#endif -#ifdef CONFIG_PROC_SYSCTL - { - .procname = "cad_pid", - .data = NULL, - .maxlen = sizeof (int), - .mode = 0600, - .proc_handler = proc_do_cad_pid, - },#endif { .procname = "threads-max",
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 reboot: fix cad_pid use-after-free race
In reply to Sasha LevinFrom: "Cen Zhang (Microsoft)" <[email protected]>
[ Upstream commit 5a88f78df753993469dab4d1831f8fb4256a9468 ]
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free.
kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid().
At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race.
Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list.
Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
--- include/linux/sched.h | 2 +- include/linux/sched/signal.h | 5 +---- init/main.c | 2 +- kernel/reboot.c | 19 +++++++++++++++---- kernel/signal.c | 12 ++++++++++++ 5 files changed, 30 insertions(+), 10 deletions(-)
include/linux/sched.h +1 -1
@@ -1741,7 +1741,7 @@ static inline int is_global_init(struct task_struct *tsk)/* PID to notify when Ctrl-Alt-Del sends a signal. */ -extern struct pid *cad_pid; +extern struct pid __rcu *cad_pid;/* * Per process flags
include/linux/sched/signal.h +1 -4
@@ -568,10 +568,7 @@ static inline sigset_t *sigmask_to_save(void)return res; } -static inline int kill_cad_pid (int sig,int priv) -{ -return kill_pid (cad_pid, sig, priv); -} +int kill_cad_pid (int sig,int priv);/* These can be the second arg to send_sig_info/send_group_sig_info. */ #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)
init/main.c +1 -1
@@ -1503,7 +1503,7 @@ static noinline void __init kernel_init_freeable(void)*/ set_mems_allowed (node_states[N_MEMORY ]); - cad_pid =get_pid (task_pid (current)); +rcu_assign_pointer (cad_pid,get_pid (task_pid (current)));smp_prepare_cpus (setup_max_cpus);
kernel/reboot.c +15 -4
@@ -13,7 +13,9 @@#include <linux/kexec.h> #include <linux/kmod.h> #include <linux/kmsg_dump.h> +#include <linux/rcupdate.h> #include <linux/reboot.h> +#include <linux/sched/signal.h> #include <linux/suspend.h> #include <linux/syscalls.h> #include <linux/syscore_ops.h>
@@ -24,8 +26,7 @@*/ static int C_A_D =1 ; -struct pid *cad_pid; -EXPORT_SYMBOL (cad_pid); +struct pid __rcu *cad_pid;#if defined(CONFIG_ARM )#define DEFAULT_REBOOT_MODE = REBOOT_HARD
@@ -1264,10 +1265,14 @@ static int proc_do_cad_pid(struct ctl_table *table, int write, void *buffer, {struct ctl_table tmp_table = *table;struct pid *new_pid; +struct pid *old_pid;pid_t tmp_pid;int r; - tmp_pid =pid_vnr (cad_pid); +rcu_read_lock (); + tmp_pid =pid_vnr (rcu_dereference (cad_pid)); +rcu_read_unlock (); + tmp_table.data = &tmp_pid; r =proc_dointvec (&tmp_table, write, buffer, lenp, ppos);
@@ -1278,7 +1283,13 @@ static int proc_do_cad_pid(struct ctl_table *table, int write, void *buffer,if (!new_pid)return -ESRCH ; -put_pid (xchg (&cad_pid, new_pid)); + old_pid =unrcu_pointer (xchg (&cad_pid,RCU_INITIALIZER (new_pid))); +/* +* Wait for cad_pid readers before put_pid(). We cannot use +* call_rcu() here because free_pid() already owns pid->rcu. +*/ +synchronize_rcu (); +put_pid (old_pid);return 0 ; }
kernel/signal.c +12 -0
@@ -1950,6 +1950,18 @@ int kill_pid(struct pid *pid, int sig, int priv) }EXPORT_SYMBOL (kill_pid); +int kill_cad_pid (int sig,int priv) +{ +int ret; + +rcu_read_lock (); + ret =kill_pid (rcu_dereference (cad_pid), sig, priv); +rcu_read_unlock (); + +return ret; +} +EXPORT_SYMBOL (kill_cad_pid); +#ifdef CONFIG_POSIX_TIMERS /* * These functions handle POSIX timer signals. POSIX timers use
Signature · 1 line
2.53.0