Unverified Commit a27e64de authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14062 CVE-2024-53054 

Merge Pull Request from: @ci-robot 
 
PR sync from: Chen Ridong <chenridong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/2IWKIZDLXJ4S6PBMHHVNZVBUUC5QTHAZ/ 
CVE-2024-53054

Chen Ridong (2):
  [Huawei] Revert "cgroup: Fix AA deadlock caused by cgroup_bpf_release"
  cgroup/bpf: use a dedicated workqueue for cgroup bpf destruction


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IB5KQK 
 
Link:https://gitee.com/openeuler/kernel/pulls/14062

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents a01c02df becedc16

kernel/bpf/cgroup.c

+18 −1
Original line number Diff line number Diff line
@@ -22,6 +22,23 @@ 
DEFINE_STATIC_KEY_ARRAY_FALSE(cgroup_bpf_enabled_key, MAX_CGROUP_BPF_ATTACH_TYPE);

EXPORT_SYMBOL(cgroup_bpf_enabled_key);



/*

 * cgroup bpf destruction makes heavy use of work items and there can be a lot

 * of concurrent destructions.  Use a separate workqueue so that cgroup bpf

 * destruction work items don't end up filling up max_active of system_wq

 * which may lead to deadlock.

 */

static struct workqueue_struct *cgroup_bpf_destroy_wq;



static int __init cgroup_bpf_wq_init(void)

{

	cgroup_bpf_destroy_wq = alloc_workqueue("cgroup_bpf_destroy", 0, 1);

	if (!cgroup_bpf_destroy_wq)

		panic("Failed to alloc workqueue for cgroup bpf destroy.\n");

	return 0;

}

core_initcall(cgroup_bpf_wq_init);



void cgroup_bpf_offline(struct cgroup *cgrp)

{

	cgroup_get(cgrp);
@@ -160,7 +177,7 @@ static void cgroup_bpf_release_fn(struct percpu_ref *ref) 
	struct cgroup *cgrp = container_of(ref, struct cgroup, bpf.refcnt);



	INIT_WORK(&cgrp->bpf.release_work, cgroup_bpf_release);

	queue_work(cgroup_destroy_wq, &cgrp->bpf.release_work);

	queue_work(cgroup_bpf_destroy_wq, &cgrp->bpf.release_work);

}



/* Get underlying bpf_prog of bpf_prog_list entry, regardless if it's through

kernel/cgroup/cgroup-internal.h

+0 −1
Original line number Diff line number Diff line
@@ -14,7 +14,6 @@ extern spinlock_t trace_cgroup_path_lock; 
extern char trace_cgroup_path[TRACE_CGROUP_PATH_LEN];

extern bool cgroup_debug;

extern void __init enable_debug_cgroup(void);

extern struct workqueue_struct *cgroup_destroy_wq;



/*

 * cgroup_path() takes a spin lock. It is good practice not to take

kernel/cgroup/cgroup.c

+1 −1
Original line number Diff line number Diff line
@@ -123,7 +123,7 @@ DEFINE_PERCPU_RWSEM(cgroup_threadgroup_rwsem); 
 * destruction work items don't end up filling up max_active of system_wq

 * which may lead to deadlock.

 */

struct workqueue_struct *cgroup_destroy_wq;

static struct workqueue_struct *cgroup_destroy_wq;



/* generate an array of cgroup subsystem pointers */

#define SUBSYS(_x) [_x ## _cgrp_id] = &_x ## _cgrp_subsys,