Commit 306a6db1 authored by Zeng Heng's avatar Zeng Heng
Browse files

arm64/mpam: Fix use-after-free when deleting resource groups 

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I97KAV



--------------------------------

Refer to the below commit:

commit b8511ccc ("x86/resctrl: Fix use-after-free when deleting resource groups")

Before removing rdtgroup, we need to refer to waitcount counter, otherwise
when unmounting the resctrl file system or deleting ctrl_mon groups, and
there were a waiter on resctrl system, then a use-after-free issue would
occurs. Fix that by removing rdtgroup after checking the waitcount.

Fixes: 3b856c03b36a ("arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak")
Signed-off-by: default avatarZeng Heng <zengheng4@huawei.com>
parent 2ad5d68f

fs/resctrlfs.c

+8 −2
Original line number Diff line number Diff line
@@ -485,6 +485,9 @@ static void free_all_child_rdtgrp(struct resctrl_group *rdtgrp) 
		/* rmid may not be used */

		rmid_free(sentry->mon.rmid);

		list_del(&sentry->mon.crdtgrp_list);

		if (atomic_read(&sentry->waitcount) != 0)

			sentry->flags = RDT_DELETED;

		else

			rdtgroup_remove(sentry);

	}

}
@@ -519,6 +522,9 @@ static void rmdir_all_sub(void) 


		kernfs_remove(rdtgrp->kn);

		list_del(&rdtgrp->resctrl_group_list);

		if (atomic_read(&rdtgrp->waitcount) != 0)

			rdtgrp->flags = RDT_DELETED;

		else

			rdtgroup_remove(rdtgrp);

	}

	/* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */