cgroup refcount is bogus when cgroup_sk_alloc is disabled
Bug #1886860 reported by
Thadeu Lima de Souza Cascardo
This bug affects 2 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Invalid
|
Undecided
|
Thadeu Lima de Souza Cascardo | ||
Bionic |
Fix Released
|
High
|
Thadeu Lima de Souza Cascardo | ||
Eoan |
Won't Fix
|
Undecided
|
Thadeu Lima de Souza Cascardo | ||
Focal |
Fix Committed
|
Undecided
|
Thadeu Lima de Souza Cascardo | ||
Groovy |
Invalid
|
Undecided
|
Thadeu Lima de Souza Cascardo | ||
linux-oem-5.6 (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bionic |
Invalid
|
Undecided
|
Unassigned | ||
Eoan |
Invalid
|
Undecided
|
Unassigned | ||
Focal |
Fix Released
|
Undecided
|
Unassigned | ||
Groovy |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Impact]
When net_prio and net_cls cgroups are used, cgroup refcount is bogus, as it's not incremented anymore, but decremented when sockets are closed.
This might lead to crashes possibly because of use-after-free when packets are received as shown in LP #1886668.
[Test case]
Ran reproducer from comment #2.
[Regression potential]
We could break the use of cgroup bpf. The use of cgroup bpf looks to still be working from the reproducer.
CVE References
Changed in linux (Ubuntu Bionic): | |
status: | New → Confirmed |
importance: | Undecided → High |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Groovy): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Focal): | |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Groovy): | |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Focal): | |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
Changed in linux (Ubuntu Eoan): | |
assignee: | nobody → Thadeu Lima de Souza Cascardo (cascardo) |
status: | Incomplete → In Progress |
Changed in linux (Ubuntu Bionic): | |
status: | Confirmed → In Progress |
Changed in linux (Ubuntu Groovy): | |
status: | In Progress → Invalid |
description: | updated |
Changed in linux-oem-5.6 (Ubuntu Focal): | |
status: | New → Fix Committed |
Changed in linux-oem-5.6 (Ubuntu Bionic): | |
status: | New → Invalid |
Changed in linux-oem-5.6 (Ubuntu Eoan): | |
status: | New → Invalid |
Changed in linux (Ubuntu Bionic): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Eoan): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Focal): | |
status: | In Progress → Fix Committed |
tags: |
added: verification-done-focal removed: verification-needed-focal |
tags: |
added: verification-needed-focal removed: verification-done-focal |
tags: |
added: verification-done-bionic removed: verification-needed-bionic |
To post a comment you must log in.
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1886860
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.