cgroup: rdma: free idle pools during cgroup teardown
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH 1/1 cgroup: rdma: free idle pools during cgroup teardown
From: Daming Li <[email protected]>
rdmacg_css_offline() converts each pool to all-max limits so the existing reclaim path can free it after the last uncharge. However, zero-usage pools are already reclaimable at that point and leaving them linked until rdmacg_css_free() lets later device teardown hit a use-after-free when free_cg_rpool_locked() deletes cg_node from a freed cgroup list head.
Free zero-usage pools directly from rdmacg_css_offline() while holding rdmacg_mutex. This keeps the existing reclaim rule, avoids new lifetime states, and ensures a cgroup cannot be freed with reclaimable rdmacg pools still attached.
--- kernel/cgroup/rdma.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
kernel/cgroup/rdma.c +8 -4
@@ -587,18 +587,22 @@ static void rdmacg_css_free(struct cgroup_subsys_state *css)* * This function is called when @css is about to go away and responsible * for shooting down all rdmacg associated with @css. As part of that it -* marks all the resource pool entries to max value, so that when resources are -* uncharged, associated resource pool can be freed as well. +* marks all the resource pool entries to max value, so that active pools can +* be freed when resources are uncharged and idle pools can be freed +* immediately. */ static void rdmacg_css_offline (struct cgroup_subsys_state *css) {struct rdma_cgroup *cg =css_rdmacg (css); -struct rdmacg_resource_pool *rpool; +struct rdmacg_resource_pool *rpool, *tmp;mutex_lock (&rdmacg_mutex); -list_for_each_entry (rpool, &cg->rpools, cg_node) +list_for_each_entry_safe (rpool, tmp, &cg->rpools, cg_node) {set_all_resource_max_limit (rpool); +if (rpool->usage_sum ==0 ) +free_cg_rpool_locked (rpool); + }mutex_unlock (&rdmacg_mutex); }
Signature · 1 line
2.34.1
Hi,
Quoted 9 lines · Ren Wei
From: Daming Li <[email protected]>
rdmacg_css_offline()converts each pool to all-max limits so the existing reclaim path can free it after the last uncharge. However, zero-usage pools are already reclaimable at that point and leaving them linked untilrdmacg_css_free()lets later device teardown hit a use-after-free whenfree_cg_rpool_locked()deletescg_nodefrom a freed cgroup list head.
Quoted 4 lines
Free zero-usage pools directly from
rdmacg_css_offline()while holdingrdmacg_mutex. This keeps the existing reclaim rule, avoids new lifetime states, and ensures a cgroup cannot be freed with reclaimable rdmacg pools still attached.
Looks good to me.
One minor note: the offline path skips rpool_has_persistent_state() and frees idle pools unconditionally. This means peak/event stats are lost earlier than before (at offline vs. at free). This is fine given the cgroup is dying, and css_free() cleans up remaining pools anyway.
Thanks,
--
Tao
Quoted 8 lines · Ren Wei
From: Daming Li <[email protected]>
rdmacg_css_offline()converts each pool to all-max limits so the existing reclaim path can free it after the last uncharge. However, zero-usage pools are already reclaimable at that point and leaving them linked untilrdmacg_css_free()lets later device teardown hit a use-after-free whenfree_cg_rpool_locked()deletescg_nodefrom a freed cgroup list head.
That's a valid problem and good analysis. The rpool->cg_node points to rdma_cgroup w/out bumping a refcount on respective css hence the observed UaF.
Quoted 4 lines
Free zero-usage pools directly from
rdmacg_css_offline()while holdingrdmacg_mutex. This keeps the existing reclaim rule, avoids new lifetime states, and ensures a cgroup cannot be freed with reclaimable rdmacg pools still attached.
I see this approach works (without explicit ref bump and complications arising from that tracking).
The shortened availability of events/peak should be OK as those are meant to be only for onlined cgs.
Quoted 11 lines
Fixes 39d3e7584a68 ("rdmacg: Added rdma cgroup controller")Reported-by Yuan Tan <[email protected]>Reported-by Zhengchuan Liang <[email protected]>Reported-by Xin Liu <[email protected]>Assisted-by Codex:GPT-5.4Co-developed-by Luxing Yin <[email protected]>Signed-off-by Luxing Yin <[email protected]>Signed-off-by Daming Li <[email protected]>Signed-off-by Ren Wei <[email protected]>
Quoted 3 lines
--- kernel/cgroup/rdma.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)