FAILED: patch "[PATCH] reboot: fix cad_pid use-after-free race" failed to apply to 6.1-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 5a88f78df753993469dab4d1831f8fb4256a9468
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091655-decent-swimsuit-d207@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5a88f78df753993469dab4d1831f8fb4256a9468 Mon Sep 17 00:00:00 2001
From: "Cen Zhang (Microsoft)" <[email protected]>
Date: Fri, 14 Aug 2026 00:09:44 -0400
Subject: [PATCH] reboot: fix cad_pid use-after-free race
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free.
kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid().
At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race.
Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list.
Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
include/linux/sched.h +1 -1
@@ -1778,7 +1778,7 @@ static inline bool is_lazy_mmu_mode_active(void) }#endif -extern struct pid *cad_pid; +extern struct pid __rcu *cad_pid;/* * Per process flags
include/linux/sched/signal.h +1 -4
@@ -562,10 +562,7 @@ static inline sigset_t *sigmask_to_save(void)return res; } -static inline int kill_cad_pid (int sig,int priv) -{ -return kill_pid (cad_pid, sig, priv); -} +int kill_cad_pid (int sig,int priv);/* These can be the second arg to send_sig_info/send_group_sig_info. */ #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)
init/main.c +1 -1
@@ -1644,7 +1644,7 @@ static noinline void __init kernel_init_freeable(void)*/ set_mems_allowed (node_states[N_MEMORY ]); - cad_pid =get_pid (task_pid (current)); +rcu_assign_pointer (cad_pid,get_pid (task_pid (current)));smp_prepare_cpus (setup_max_cpus);
kernel/reboot.c +15 -4
@@ -13,7 +13,9 @@#include <linux/kexec.h> #include <linux/kmod.h> #include <linux/kmsg_dump.h> +#include <linux/rcupdate.h> #include <linux/reboot.h> +#include <linux/sched/signal.h> #include <linux/suspend.h> #include <linux/syscalls.h> #include <linux/syscore_ops.h>
@@ -24,8 +26,7 @@*/ static int C_A_D =1 ; -struct pid *cad_pid; -EXPORT_SYMBOL (cad_pid); +struct pid __rcu *cad_pid;#if defined(CONFIG_ARM )#define DEFAULT_REBOOT_MODE = REBOOT_HARD
@@ -1371,10 +1372,14 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffe {struct ctl_table tmp_table = *table;struct pid *new_pid; +struct pid *old_pid;pid_t tmp_pid;int r; - tmp_pid =pid_vnr (cad_pid); +rcu_read_lock (); + tmp_pid =pid_vnr (rcu_dereference (cad_pid)); +rcu_read_unlock (); + tmp_table.data = &tmp_pid; r =proc_dointvec (&tmp_table, write, buffer, lenp, ppos);
@@ -1385,7 +1390,13 @@ static int proc_do_cad_pid(const struct ctl_table *table, int write, void *buffeif (!new_pid)return -ESRCH ; -put_pid (xchg (&cad_pid, new_pid)); + old_pid =unrcu_pointer (xchg (&cad_pid,RCU_INITIALIZER (new_pid))); +/* +* Wait for cad_pid readers before put_pid(). We cannot use +* call_rcu() here because free_pid() already owns pid->rcu. +*/ +synchronize_rcu (); +put_pid (old_pid);return 0 ; }
kernel/signal.c +12 -0
@@ -1899,6 +1899,18 @@ int kill_pid(struct pid *pid, int sig, int priv) }EXPORT_SYMBOL (kill_pid); +int kill_cad_pid (int sig,int priv) +{ +int ret; + +rcu_read_lock (); + ret =kill_pid (rcu_dereference (cad_pid), sig, priv); +rcu_read_unlock (); + +return ret; +} +EXPORT_SYMBOL (kill_cad_pid); +#ifdef CONFIG_POSIX_TIMERS /* * These functions handle POSIX timer signals. POSIX timers use
Sasha Levin
maintainerPATCH 1/2 sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
From: Oleg Nesterov <[email protected]>
[ Upstream commit 7170ca01623b399c97f2ae9d3e228badc1f25ea3 ]
cad_pid is global, and kill_cad_pid() is only used in the root namespace.
However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace. This makes no sense and is simply wrong.
Move it to kern_reboot_table[] where it logically belongs; this ensures that only GLOBAL_ROOT_UID can read/modify this sysctl.
Note that this patch doesn't preserve "#ifdef CONFIG_PROC_SYSCTL" around the "cad_pid"; CONFIG_PROC_SYSCTL selects CONFIG_SYSCTL, so it is always set when kern_reboot_table[] is compiled.
Backport notes for Linux 6.1:
The cad_pid handler and sysctl entry still live in kernel/sysctl.c in this tree. Move that existing handler and entry directly to reboot.c; do not import the absent PID-namespace sysctl infrastructure. Use a local ctl_table copy and proc_dointvec(), since __do_proc_dointvec() is private to sysctl.c, while retaining the non-const 6.1 handler API and the required table sentinel. No new functions are introduced.
Keep reboot sysctl registration independent of CONFIG_SYSFS by making the existing kernel_reboot_sysctls_init() its own late initcall. This preserves cad_pid availability with PROC_SYSCTL=y and SYSFS=n.
Relocate the existing TASK_SIZE_OF fallback, unchanged, before cad_pid in sched.h. Its conditional boundary lets the target's declaration hunk merge cleanly with Git's default merge algorithm despite the absence of upstream's adjacent lazy-MMU helpers. Do not add those helpers or alter the cad_pid declaration in this dependency.
Guard the existing POSIX-timer-only sigqueue helpers with CONFIG_POSIX_TIMERS and align their introductory comment with upstream. This supplies the context needed for 5a88f78df753 ("reboot: fix cad_pid use-after-free race") to cherry-pick cleanly without pulling in timer refactoring. Its RCU lifetime fix remains in the target commit.
[ sashal: Reduced backport -- upstream 7170ca01623b3 touches 2 file(s), this
backport carries 4. Not backported here:
kernel/pid.c
This note is generated from the file lists only; see the resolution record for the reasoning. ]
Stable-dep-of: 5a88f78df753 ("reboot: fix cad_pid use-after-free race")
--- include/linux/sched.h | 8 ++++---- kernel/reboot.c | 40 +++++++++++++++++++++++++++++++++++----- kernel/signal.c | 12 +++++------- kernel/sysctl.c | 31 ------------------------------- 4 files changed, 44 insertions(+), 47 deletions(-)
include/linux/sched.h +4 -4
@@ -1724,6 +1724,10 @@ static inline int is_global_init(struct task_struct *tsk)return task_tgid_nr (tsk) ==1 ; } +#ifndef TASK_SIZE_OF +#define TASK_SIZE_OF (tsk) TASK_SIZE +#endif +extern struct pid *cad_pid;/*
@@ -2292,10 +2296,6 @@ static inline bool vcpu_is_preempted(int cpu)extern long sched_setaffinity (pid_t pid,const struct cpumask *new_mask);extern long sched_getaffinity (pid_t pid,struct cpumask *mask); -#ifndef TASK_SIZE_OF -#define TASK_SIZE_OF (tsk) TASK_SIZE -#endif -#ifdef CONFIG_SMP static inline bool owner_on_cpu (struct task_struct *owner) {
kernel/reboot.c +35 -5
@@ -1257,7 +1257,32 @@ static struct attribute *reboot_attrs[] = { NULL, }; +#endif /* CONFIG_SYSFS */ + #ifdef CONFIG_SYSCTL +static int proc_do_cad_pid(struct ctl_table *table, int write, void *buffer, + size_t *lenp, loff_t *ppos) +{ + struct ctl_table tmp_table = *table; + struct pid *new_pid; + pid_t tmp_pid; + int r; + + tmp_pid = pid_vnr(cad_pid); + tmp_table.data = &tmp_pid; + + r = proc_dointvec(&tmp_table, write, buffer, lenp, ppos); + if (r || !write) + return r; + + new_pid = find_get_pid(tmp_pid); + if (!new_pid) + return -ESRCH; + + put_pid(xchg(&cad_pid, new_pid)); + return 0; +} + static struct ctl_table kern_reboot_table[] = { { .procname = "poweroff_cmd",
@@ -1273,17 +1298,24 @@ static struct ctl_table kern_reboot_table[] = { .mode = 0644, .proc_handler = proc_dointvec, }, + { + .procname = "cad_pid", + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_do_cad_pid, + }, { } }; -static void __init kernel_reboot_sysctls_init (void ) +static int __init kernel_reboot_sysctls_init (void ) {register_sysctl_init ("kernel" , kern_reboot_table); +return 0 ; } -#else -#define kernel_reboot_sysctls_init () do { } while (0) +late_initcall (kernel_reboot_sysctls_init);#endif /* CONFIG_SYSCTL */ +#ifdef CONFIG_SYSFS static const struct attribute_group reboot_attr_group = { .attrs = reboot_attrs, };
@@ -1303,8 +1335,6 @@ static int __init reboot_ksysfs_init(void)return ret; } -kernel_reboot_sysctls_init (); -return 0 ; }late_initcall (reboot_ksysfs_init);
kernel/signal.c +5 -7
@@ -1937,14 +1937,10 @@ int kill_pid(struct pid *pid, int sig, int priv) }EXPORT_SYMBOL (kill_pid); +#ifdef CONFIG_POSIX_TIMERS /* -* These functions support sending signals using preallocated sigqueue -* structures. This is needed "because realtime applications cannot -* afford to lose notifications of asynchronous events, like timer -* expirations or I/O completions". In the case of POSIX Timers -* we allocate the sigqueue structure from the timer_create. If this -* allocation fails we are able to report the failure to the application -* with an EAGAIN error. +* These functions handle POSIX timer signals. POSIX timers use +* preallocated sigqueue structs for sending signals. */ struct sigqueue *sigqueue_alloc (void ) {
@@ -2024,6 +2020,8 @@ int send_sigqueue(struct sigqueue *q, struct pid *pid, enum pid_type type) return ret; } +#endif /* CONFIG_POSIX_TIMERS */ +static void do_notify_pidfd (struct task_struct *task) {struct pid *pid;
kernel/sysctl.c +0 -31
@@ -1344,28 +1344,6 @@ int proc_dointvec_ms_jiffies(struct ctl_table *table, int write, void *buffer, do_proc_dointvec_ms_jiffies_conv, NULL); } -static int proc_do_cad_pid (struct ctl_table *table,int write,void *buffer, -size_t *lenp,loff_t *ppos) -{ -struct pid *new_pid; -pid_t tmp; -int r; - - tmp =pid_vnr (cad_pid); - - r =__do_proc_dointvec (&tmp, table, write, buffer, - lenp, ppos,NULL ,NULL ); -if (r || !write) -return r; - - new_pid =find_get_pid (tmp); -if (!new_pid) -return -ESRCH ; - -put_pid (xchg (&cad_pid, new_pid)); -return 0 ; -} -/** * proc_do_large_bitmap - read/write from/to a large bitmap * @table: the sysctl table
@@ -1801,15 +1779,6 @@ static struct ctl_table kern_table[] = { .mode = 0644, .proc_handler = sysrq_sysctl_handler, }, -#endif -#ifdef CONFIG_PROC_SYSCTL - { - .procname = "cad_pid", - .data = NULL, - .maxlen = sizeof (int), - .mode = 0600, - .proc_handler = proc_do_cad_pid, - },#endif { .procname = "threads-max",
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 reboot: fix cad_pid use-after-free race
From: "Cen Zhang (Microsoft)" <[email protected]>
[ Upstream commit 5a88f78df753993469dab4d1831f8fb4256a9468 ]
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid() reads it and passes it to pid_vnr() without protecting the lifetime of the referenced struct pid. A concurrent writer can replace cad_pid and drop the final reference to the old struct pid after the reader has loaded the pointer but before pid_vnr() has finished dereferencing it, causing a use-after-free.
kill_cad_pid() has the same lifetime race when it passes cad_pid to kill_pid().
At the time this issue was reported, an unprivileged user could reach the sysctl through user and PID namespaces because cad_pid was registered in pid_table[]. Moving cad_pid back to the global reboot sysctl table corrected that namespace and permission mismatch, but did not fix the underlying lifetime race.
Fix this by treating cad_pid as an RCU-protected pointer at both read sites and by waiting for a grace period before dropping the old reference on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid() also queues pid->rcu; queueing the same rcu_head twice can corrupt the RCU callback list.
Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level kernel/pid.c:556 pid_vnr() # calls pid_nr_ns() kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
--- include/linux/sched.h | 2 +- include/linux/sched/signal.h | 5 +---- init/main.c | 2 +- kernel/reboot.c | 19 +++++++++++++++---- kernel/signal.c | 12 ++++++++++++ 5 files changed, 30 insertions(+), 10 deletions(-)
include/linux/sched.h +1 -1
@@ -1728,7 +1728,7 @@ static inline int is_global_init(struct task_struct *tsk)#define TASK_SIZE_OF (tsk) TASK_SIZE#endif -extern struct pid *cad_pid; +extern struct pid __rcu *cad_pid;/* * Per process flags
include/linux/sched/signal.h +1 -4
@@ -568,10 +568,7 @@ static inline sigset_t *sigmask_to_save(void)return res; } -static inline int kill_cad_pid (int sig,int priv) -{ -return kill_pid (cad_pid, sig, priv); -} +int kill_cad_pid (int sig,int priv);/* These can be the second arg to send_sig_info/send_group_sig_info. */ #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0)
init/main.c +1 -1
@@ -1574,7 +1574,7 @@ static noinline void __init kernel_init_freeable(void)*/ set_mems_allowed (node_states[N_MEMORY ]); - cad_pid =get_pid (task_pid (current)); +rcu_assign_pointer (cad_pid,get_pid (task_pid (current)));smp_prepare_cpus (setup_max_cpus);
kernel/reboot.c +15 -4
@@ -13,7 +13,9 @@#include <linux/kexec.h> #include <linux/kmod.h> #include <linux/kmsg_dump.h> +#include <linux/rcupdate.h> #include <linux/reboot.h> +#include <linux/sched/signal.h> #include <linux/suspend.h> #include <linux/syscalls.h> #include <linux/syscore_ops.h>
@@ -24,8 +26,7 @@*/ static int C_A_D =1 ; -struct pid *cad_pid; -EXPORT_SYMBOL (cad_pid); +struct pid __rcu *cad_pid;#if defined(CONFIG_ARM )#define DEFAULT_REBOOT_MODE = REBOOT_HARD
@@ -1265,10 +1266,14 @@ static int proc_do_cad_pid(struct ctl_table *table, int write, void *buffer, {struct ctl_table tmp_table = *table;struct pid *new_pid; +struct pid *old_pid;pid_t tmp_pid;int r; - tmp_pid =pid_vnr (cad_pid); +rcu_read_lock (); + tmp_pid =pid_vnr (rcu_dereference (cad_pid)); +rcu_read_unlock (); + tmp_table.data = &tmp_pid; r =proc_dointvec (&tmp_table, write, buffer, lenp, ppos);
@@ -1279,7 +1284,13 @@ static int proc_do_cad_pid(struct ctl_table *table, int write, void *buffer,if (!new_pid)return -ESRCH ; -put_pid (xchg (&cad_pid, new_pid)); + old_pid =unrcu_pointer (xchg (&cad_pid,RCU_INITIALIZER (new_pid))); +/* +* Wait for cad_pid readers before put_pid(). We cannot use +* call_rcu() here because free_pid() already owns pid->rcu. +*/ +synchronize_rcu (); +put_pid (old_pid);return 0 ; }
kernel/signal.c +12 -0
@@ -1937,6 +1937,18 @@ int kill_pid(struct pid *pid, int sig, int priv) }EXPORT_SYMBOL (kill_pid); +int kill_cad_pid (int sig,int priv) +{ +int ret; + +rcu_read_lock (); + ret =kill_pid (rcu_dereference (cad_pid), sig, priv); +rcu_read_unlock (); + +return ret; +} +EXPORT_SYMBOL (kill_cad_pid); +#ifdef CONFIG_POSIX_TIMERS /* * These functions handle POSIX timer signals. POSIX timers use
Signature · 1 line
2.53.0