FAILED: patch "[PATCH] reboot: fix cad_pid use-after-free race" failed to apply to 6.12-stable tree

PATCH New [email protected] 2 participants 3 messages Sep 16

Subsystems (2)

Stable branch Scheduler

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-16 08:13 UTC #0 lore raw

The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x 5a88f78df753993469dab4d1831f8fb4256a9468
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091653-fester-trodden-026e@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 5a88f78df753993469dab4d1831f8fb4256a9468 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft)" <[email protected]>
Date: Fri, 14 Aug 2026 00:09:44 -0400
Subject: [PATCH] reboot: fix cad_pid use-after-free race

cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free.

kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid().

At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race.

Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list.

Original KASAN crash stack:

  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

Fixes 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid")

Reported-by [email protected]

Closes https://lore.kernel.org/all/[email protected]/ open here

Link https://lore.kernel.org/all/[email protected]/ open here

Cc [email protected]

Signed-off-by Cen Zhang (Microsoft) <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Reviewed-by Bradley Morgan <[email protected]>

Reviewed-by Oleg Nesterov <[email protected]>

Reviewed-by Pavel Tikhomirov <[email protected]>

Signed-off-by Christian Brauner (Amutable) <[email protected]>

include/linux/sched.h +1 -1

index 3f100d69b053..fdafd164a42d 100644
@@ -1778,7 +1778,7 @@ static inline bool is_lazy_mmu_mode_active(void)
 }
 #endif
 
-extern struct pid *cad_pid;
+extern struct pid __rcu *cad_pid;
 
 /*
  * Per process flags

include/linux/sched/signal.h +1 -4

index 584ae88b435e..d45a5476b97d 100644
@@ -562,10 +562,7 @@ static inline sigset_t *sigmask_to_save(void)
 	return res;
 }
 
-static inline int kill_cad_pid(int sig, int priv)
-{
-	return kill_pid(cad_pid, sig, priv);
-}
+int kill_cad_pid(int sig, int priv);
 
 /* These can be the second arg to send_sig_info/send_group_sig_info.  */
 #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)

init/main.c +1 -1

index 92d34e496a33..f46f3a8b3efd 100644
@@ -1644,7 +1644,7 @@ static noinline void __init kernel_init_freeable(void)
 	 */
 	set_mems_allowed(node_states[N_MEMORY]);
 
-	cad_pid = get_pid(task_pid(current));
+	rcu_assign_pointer(cad_pid, get_pid(task_pid(current)));
 
 	smp_prepare_cpus(setup_max_cpus);

kernel/reboot.c +15 -4

index f070c5c1103a..d177d89fcc33 100644
@@ -13,7 +13,9 @@
 #include <linux/kexec.h>
 #include <linux/kmod.h>
 #include <linux/kmsg_dump.h>
+#include <linux/rcupdate.h>
 #include <linux/reboot.h>
+#include <linux/sched/signal.h>
 #include <linux/suspend.h>
 #include <linux/syscalls.h>
 #include <linux/syscore_ops.h>

@@ -24,8 +26,7 @@
  */
 
 static int C_A_D = 1;
-struct pid *cad_pid;
-EXPORT_SYMBOL(cad_pid);
+struct pid __rcu *cad_pid;
 
 #if defined(CONFIG_ARM)
 #define DEFAULT_REBOOT_MODE		= REBOOT_HARD

@@ -1371,10 +1372,14 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
 {
 	struct ctl_table tmp_table = *table;
 	struct pid *new_pid;
+	struct pid *old_pid;
 	pid_t tmp_pid;
 	int r;
 
-	tmp_pid = pid_vnr(cad_pid);
+	rcu_read_lock();
+	tmp_pid = pid_vnr(rcu_dereference(cad_pid));
+	rcu_read_unlock();
+
 	tmp_table.data = &tmp_pid;
 
 	r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);

@@ -1385,7 +1390,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
 	if (!new_pid)
 		return -ESRCH;
 
-	put_pid(xchg(&cad_pid, new_pid));
+	old_pid = unrcu_pointer(xchg(&cad_pid, RCU_INITIALIZER(new_pid)));
+	/*
+	 * Wait for cad_pid readers before put_pid().  We cannot use
+	 * call_rcu() here because free_pid() already owns pid->rcu.
+	 */
+	synchronize_rcu();
+	put_pid(old_pid);
 	return 0;
 }

kernel/signal.c +12 -0

index bbc0fd4cc4d7..2162fad7b940 100644
@@ -1899,6 +1899,18 @@ int kill_pid(struct pid *pid, int sig, int priv)
 }
 EXPORT_SYMBOL(kill_pid);
 
+int kill_cad_pid(int sig, int priv)
+{
+	int ret;
+
+	rcu_read_lock();
+	ret = kill_pid(rcu_dereference(cad_pid), sig, priv);
+	rcu_read_unlock();
+
+	return ret;
+}
+EXPORT_SYMBOL(kill_cad_pid);
+
 #ifdef CONFIG_POSIX_TIMERS
 /*
  * These functions handle POSIX timer signals. POSIX timers use

Sasha Levin

maintainer

2026-09-16 14:11 UTC #1 lore raw

PATCH 1/2 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]

From: Oleg Nesterov <[email protected]>

[ Upstream commit 7170ca01623b399c97f2ae9d3e228badc1f25ea3 ]

cad_pid is global, and kill_cad_pid() is only used in the root namespace.

However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.

Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.

Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.

Cc [email protected]

Fixes e054bcbe7e7a ("sysctl: move cad_pid into kernel/pid.c")

Signed-off-by Oleg Nesterov <[email protected]>

Acked-by Alexey Gladkov <[email protected]>

Reviewed-by Bradley Morgan <[email protected]>

Reviewed-by Pavel Tikhomirov <[email protected]>

Signed-off-by Joel Granados <[email protected]>

[6.12 dependency adaptation]
The stable tree still keeps cad_pid in the global kernel/sysctl.c table; it does not have the upstream per-PID-namespace table. Move the existing handler and entry directly from kernel/sysctl.c to kernel/reboot.c, using proc_dointvec() with a local table copy because __do_proc_dointvec() is private to sysctl.c. Leave kernel/pid.c unchanged and retain the mutable ctl_table required by the stable registration API.

Make the existing kernel_reboot_sysctls_init() an independent late initcall outside CONFIG_SYSFS so cad_pid remains available with PROC_SYSCTL=y and SYSFS=n, and does not depend on sysfs object allocation succeeding.

Prepare context for 5a88f78df753 without importing newer scheduler or timer
implementations: move the existing kick_process() declaration/stub before cad_pid and expand the empty stub, and guard the existing POSIX-only sigqueue helpers with CONFIG_POSIX_TIMERS using the upstream comment. No new functions are introduced, and the target's RCU fix is left for the target commit.

[ sashal: Reduced backport -- upstream 7170ca01623b3 touches 2 file(s), this
backport carries 4. Not backported here:
kernel/pid.c
This note is generated from the file lists only; see the resolution record for the reasoning. ]

Stable-dep-of: 5a88f78df753 ("reboot: fix cad_pid use-after-free race")

Signed-off-by Sasha Levin <[email protected]>

---
 include/linux/sched.h | 14 ++++++++------
 kernel/reboot.c       | 40 +++++++++++++++++++++++++++++++++++-----
 kernel/signal.c       | 12 +++++-------
 kernel/sysctl.c       | 31 -------------------------------
 4 files changed, 48 insertions(+), 49 deletions(-)

include/linux/sched.h +8 -6

index 7b97f1ec1bc0a..c7d475b0f3b47 100644
@@ -1675,6 +1675,14 @@ static inline char task_state_to_char(struct task_struct *tsk)
 	return task_index_to_char(task_state_index(tsk));
 }
 
+#ifdef CONFIG_SMP
+extern void kick_process(struct task_struct *tsk);
+#else
+static inline void kick_process(struct task_struct *tsk)
+{
+}
+#endif
+
 extern struct pid *cad_pid;
 
 /*

@@ -1953,12 +1961,6 @@ extern int wake_up_state(struct task_struct *tsk, unsigned int state);
 extern int wake_up_process(struct task_struct *tsk);
 extern void wake_up_new_task(struct task_struct *tsk);
 
-#ifdef CONFIG_SMP
-extern void kick_process(struct task_struct *tsk);
-#else
-static inline void kick_process(struct task_struct *tsk) { }
-#endif
-
 extern void __set_task_comm(struct task_struct *tsk, const char *from, bool exec);
 
 static inline void set_task_comm(struct task_struct *tsk, const char *from)

kernel/reboot.c +35 -5

index d6ee090eda943..8ca5590a6d601 100644
@@ -1280,7 +1280,32 @@ static struct attribute *reboot_attrs[] = {
 	NULL,
 };
 
+#endif /* CONFIG_SYSFS */
+
 #ifdef CONFIG_SYSCTL
+static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffer,
+			   size_t *lenp, loff_t *ppos)
+{
+	struct ctl_table tmp_table = *table;
+	struct pid *new_pid;
+	pid_t tmp_pid;
+	int r;
+
+	tmp_pid = pid_vnr(cad_pid);
+	tmp_table.data = &tmp_pid;
+
+	r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);
+	if (r || !write)
+		return r;
+
+	new_pid = find_get_pid(tmp_pid);
+	if (!new_pid)
+		return -ESRCH;
+
+	put_pid(xchg(&cad_pid, new_pid));
+	return 0;
+}
+
 static struct ctl_table kern_reboot_table[] = {
 	{
 		.procname       = "poweroff_cmd",

@@ -1296,16 +1321,23 @@ static struct ctl_table kern_reboot_table[] = {
 		.mode           = 0644,
 		.proc_handler   = proc_dointvec,
 	},
+	{
+		.procname	= "cad_pid",
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= proc_do_cad_pid,
+	},
 };
 
-static void __init kernel_reboot_sysctls_init(void)
+static int __init kernel_reboot_sysctls_init(void)
 {
 	register_sysctl_init("kernel", kern_reboot_table);
+	return 0;
 }
-#else
-#define kernel_reboot_sysctls_init() do { } while (0)
+late_initcall(kernel_reboot_sysctls_init);
 #endif /* CONFIG_SYSCTL */
 
+#ifdef CONFIG_SYSFS
 static const struct attribute_group reboot_attr_group = {
 	.attrs = reboot_attrs,
 };

@@ -1325,8 +1357,6 @@ static int __init reboot_ksysfs_init(void)
 		return ret;
 	}
 
-	kernel_reboot_sysctls_init();
-
 	return 0;
 }
 late_initcall(reboot_ksysfs_init);

kernel/signal.c +5 -7

index a11c3c9afd2b4..a665afdccecdd 100644
@@ -1936,14 +1936,10 @@ int kill_pid(struct pid *pid, int sig, int priv)
 }
 EXPORT_SYMBOL(kill_pid);
 
+#ifdef CONFIG_POSIX_TIMERS
 /*
- * These functions support sending signals using preallocated sigqueue
- * structures.  This is needed "because realtime applications cannot
- * afford to lose notifications of asynchronous events, like timer
- * expirations or I/O completions".  In the case of POSIX Timers
- * we allocate the sigqueue structure from the timer_create.  If this
- * allocation fails we are able to report the failure to the application
- * with an EAGAIN error.
+ * These functions handle POSIX timer signals. POSIX timers use
+ * preallocated sigqueue structs for sending signals.
  */
 struct sigqueue *sigqueue_alloc(void)
 {

@@ -2043,6 +2039,8 @@ int send_sigqueue(struct sigqueue *q, struct pid *pid, enum pid_type type)
 	return ret;
 }
 
+#endif /* CONFIG_POSIX_TIMERS */
+
 void do_notify_pidfd(struct task_struct *task)
 {
 	struct pid *pid = task_pid(task);

kernel/sysctl.c +0 ~~-31~~

index de58128fa5212..6a9040fdefe51 100644
@@ -1322,28 +1322,6 @@ int proc_dointvec_ms_jiffies(const struct ctl_table *table, int write, void *buf
 				do_proc_dointvec_ms_jiffies_conv, NULL);
 }
 
-static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffer,
-		size_t *lenp, loff_t *ppos)
-{
-	struct pid *new_pid;
-	pid_t tmp;
-	int r;
-
-	tmp = pid_vnr(cad_pid);
-
-	r = __do_proc_dointvec(&tmp, table, write, buffer,
-			       lenp, ppos, NULL, NULL);
-	if (r || !write)
-		return r;
-
-	new_pid = find_get_pid(tmp);
-	if (!new_pid)
-		return -ESRCH;
-
-	put_pid(xchg(&cad_pid, new_pid));
-	return 0;
-}
-
 /**
  * proc_do_large_bitmap - read/write from/to a large bitmap
  * @table: the sysctl table

@@ -1760,15 +1738,6 @@ static struct ctl_table kern_table[] = {
 		.mode		= 0644,
 		.proc_handler	= sysrq_sysctl_handler,
 	},
-#endif
-#ifdef CONFIG_PROC_SYSCTL
-	{
-		.procname	= "cad_pid",
-		.data		= NULL,
-		.maxlen		= sizeof (int),
-		.mode		= 0600,
-		.proc_handler	= proc_do_cad_pid,
-	},
 #endif
 	{
 		.procname	= "threads-max",

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-16 14:11 UTC #2 lore raw

PATCH 2/2 reboot: fix cad_pid use-after-free race

From: "Cen Zhang (Microsoft)" <[email protected]>

[ Upstream commit 5a88f78df753993469dab4d1831f8fb4256a9468 ]

kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid().

Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side.

call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list.

Original KASAN crash stack:

  kernel/pid.c:545 pid_nr_ns()        # reads freed pid->level
  kernel/pid.c:556 pid_vnr()          # calls pid_nr_ns()
  kernel/pid.c:775 proc_do_cad_pid()  # calls pid_vnr(cad_pid)

Fixes 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid")

Reported-by [email protected]

Closes https://lore.kernel.org/all/[email protected]/ open here

Link https://lore.kernel.org/all/[email protected]/ open here

Cc [email protected]

Signed-off-by Cen Zhang (Microsoft) <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Reviewed-by Bradley Morgan <[email protected]>

Reviewed-by Oleg Nesterov <[email protected]>

Reviewed-by Pavel Tikhomirov <[email protected]>

Signed-off-by Christian Brauner (Amutable) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 include/linux/sched.h        |  2 +-
 include/linux/sched/signal.h |  5 +----
 init/main.c                  |  2 +-
 kernel/reboot.c              | 19 +++++++++++++++----
 kernel/signal.c              | 12 ++++++++++++
 5 files changed, 30 insertions(+), 10 deletions(-)

include/linux/sched.h +1 -1

index c7d475b0f3b47..0fb5bb6c30d3f 100644
@@ -1683,7 +1683,7 @@ static inline void kick_process(struct task_struct *tsk)
 }
 #endif
 
-extern struct pid *cad_pid;
+extern struct pid __rcu *cad_pid;
 
 /*
  * Per process flags

include/linux/sched/signal.h +1 -4

index c8ed09ac29ac5..21e496bb1c1bd 100644
@@ -558,10 +558,7 @@ static inline sigset_t *sigmask_to_save(void)
 	return res;
 }
 
-static inline int kill_cad_pid(int sig, int priv)
-{
-	return kill_pid(cad_pid, sig, priv);
-}
+int kill_cad_pid(int sig, int priv);
 
 /* These can be the second arg to send_sig_info/send_group_sig_info.  */
 #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)

init/main.c +1 -1

index df9db4d47868a..4872cc96174ad 100644
@@ -1523,7 +1523,7 @@ static noinline void __init kernel_init_freeable(void)
 	 */
 	set_mems_allowed(node_states[N_MEMORY]);
 
-	cad_pid = get_pid(task_pid(current));
+	rcu_assign_pointer(cad_pid, get_pid(task_pid(current)));
 
 	smp_prepare_cpus(setup_max_cpus);

kernel/reboot.c +15 -4

index 8ca5590a6d601..24c5bc26385af 100644
@@ -13,7 +13,9 @@
 #include <linux/kexec.h>
 #include <linux/kmod.h>
 #include <linux/kmsg_dump.h>
+#include <linux/rcupdate.h>
 #include <linux/reboot.h>
+#include <linux/sched/signal.h>
 #include <linux/suspend.h>
 #include <linux/syscalls.h>
 #include <linux/syscore_ops.h>

@@ -24,8 +26,7 @@
  */
 
 static int C_A_D = 1;
-struct pid *cad_pid;
-EXPORT_SYMBOL(cad_pid);
+struct pid __rcu *cad_pid;
 
 #if defined(CONFIG_ARM)
 #define DEFAULT_REBOOT_MODE		= REBOOT_HARD

@@ -1288,10 +1289,14 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
 {
 	struct ctl_table tmp_table = *table;
 	struct pid *new_pid;
+	struct pid *old_pid;
 	pid_t tmp_pid;
 	int r;
 
-	tmp_pid = pid_vnr(cad_pid);
+	rcu_read_lock();
+	tmp_pid = pid_vnr(rcu_dereference(cad_pid));
+	rcu_read_unlock();
+
 	tmp_table.data = &tmp_pid;
 
 	r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos);

@@ -1302,7 +1307,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe
 	if (!new_pid)
 		return -ESRCH;
 
-	put_pid(xchg(&cad_pid, new_pid));
+	old_pid = unrcu_pointer(xchg(&cad_pid, RCU_INITIALIZER(new_pid)));
+	/*
+	 * Wait for cad_pid readers before put_pid().  We cannot use
+	 * call_rcu() here because free_pid() already owns pid->rcu.
+	 */
+	synchronize_rcu();
+	put_pid(old_pid);
 	return 0;
 }

kernel/signal.c +12 -0

index a665afdccecdd..1a6cd0503beb5 100644
@@ -1936,6 +1936,18 @@ int kill_pid(struct pid *pid, int sig, int priv)
 }
 EXPORT_SYMBOL(kill_pid);
 
+int kill_cad_pid(int sig, int priv)
+{
+	int ret;
+
+	rcu_read_lock();
+	ret = kill_pid(rcu_dereference(cad_pid), sig, priv);
+	rcu_read_unlock();
+
+	return ret;
+}
+EXPORT_SYMBOL(kill_cad_pid);
+
 #ifdef CONFIG_POSIX_TIMERS
 /*
  * These functions handle POSIX timer signals. POSIX timers use

Signature · 1 line

2.53.0