diff --git a/0022-cpuview-fix-possible-use-after-free-in-find_proc_sta.patch b/0022-cpuview-fix-possible-use-after-free-in-find_proc_sta.patch new file mode 100644 index 0000000000000000000000000000000000000000..587c23f30023085ac92d839a3af41d32b9d4e777 --- /dev/null +++ b/0022-cpuview-fix-possible-use-after-free-in-find_proc_sta.patch @@ -0,0 +1,109 @@ +From 765d4c48aeaad779008f82ff6643d9cdbe917bd1 Mon Sep 17 00:00:00 2001 +From: yangjiaqi +Date: Wed, 22 Mar 2023 09:31:04 +0800 +Subject: [PATCH] cpuview: fix possible use-after-free in find_proc_stat_node + +Signed-off-by: yangjiaqi +--- + src/proc_cpuview.c | 36 ++++++++++++++++++++++++++++++++---- + 1 file changed, 32 insertions(+), 4 deletions(-) + +diff --git a/src/proc_cpuview.c b/src/proc_cpuview.c +index 75006a6..207a6df 100644 +--- a/src/proc_cpuview.c ++++ b/src/proc_cpuview.c +@@ -171,6 +171,7 @@ static struct cg_proc_stat *add_proc_stat_node(struct cg_proc_stat *new_node) + } + + out_rwlock_unlock: ++ pthread_mutex_lock(&rv->lock); + pthread_rwlock_unlock(&head->lock); + return move_ptr(rv); + } +@@ -224,6 +225,7 @@ static bool cgroup_supports(const char *controller, const char *cgroup, + return faccessat(cfd, path, F_OK, 0) == 0; + } + ++/* should be called with wr-locked list */ + static struct cg_proc_stat *prune_proc_stat_list(struct cg_proc_stat *node) + { + struct cg_proc_stat *first = NULL; +@@ -232,6 +234,31 @@ static struct cg_proc_stat *prune_proc_stat_list(struct cg_proc_stat *node) + if (!cgroup_supports("cpu", node->cg, "cpu.shares")) { + struct cg_proc_stat *cur = node; + ++ /* ++ * We need to ensure that no one referenced this node, ++ * because we are going to remove it from the list and free memory. ++ * ++ * If we can't grab the lock then just keep this node for now. ++ */ ++ if (pthread_mutex_trylock(&cur->lock)) ++ goto next; ++ ++ /* ++ * Yes, we can put lock back just after taking it, as we ensured ++ * that we are only one user of it right now. ++ * ++ * It follows from three facts: ++ * - we are under pthread_rwlock_wrlock(hash_table_bucket) ++ * - pthread_mutex_lock is taken by find_proc_stat_node() ++ * with pthread_rwlock_rdlock(hash_table_bucket) held. ++ * - pthread_mutex_lock is taken by add_proc_stat_node() ++ * with pthread_rwlock_wrlock(hash_table_bucket) held. ++ * ++ * It means that nobody can get a pointer to (cur) node in a parallel ++ * thread and all old users of (cur) node have released pthread_mutex_lock(cur). ++ */ ++ pthread_mutex_unlock(&cur->lock); ++ + if (prev) + prev->next = node->next; + else +@@ -242,6 +269,7 @@ static struct cg_proc_stat *prune_proc_stat_list(struct cg_proc_stat *node) + + free_proc_stat_node(cur); + } else { ++next: + if (!first) + first = node; + prev = node; +@@ -279,6 +307,7 @@ static struct cg_proc_stat *find_proc_stat_node(struct cg_proc_stat_head *head, + { + struct cg_proc_stat *node; + ++ prune_proc_stat_history(); + pthread_rwlock_rdlock(&head->lock); + + if (!head->next) { +@@ -289,15 +318,16 @@ static struct cg_proc_stat *find_proc_stat_node(struct cg_proc_stat_head *head, + node = head->next; + + do { +- if (strcmp(cg, node->cg) == 0) ++ if (strcmp(cg, node->cg) == 0) { ++ pthread_mutex_lock(&node->lock); + goto out; ++ } + } while ((node = node->next)); + + node = NULL; + + out: + pthread_rwlock_unlock(&head->lock); +- prune_proc_stat_history(); + return node; + } + +@@ -318,8 +348,6 @@ static struct cg_proc_stat *find_or_create_proc_stat_node(struct cpuacct_usage * + lxcfs_debug("New stat node (%d) for %s\n", cpu_count, cg); + } + +- pthread_mutex_lock(&node->lock); +- + /* + * If additional CPUs on the host have been enabled, CPU usage counter + * arrays have to be expanded. +-- +2.30.0 + diff --git a/0023-proc-fix-proc-diskstats-output-format.patch b/0023-proc-fix-proc-diskstats-output-format.patch new file mode 100644 index 0000000000000000000000000000000000000000..458e499e2e3a46f663f3ba4c361a813d3afb4235 --- /dev/null +++ b/0023-proc-fix-proc-diskstats-output-format.patch @@ -0,0 +1,91 @@ +From d928f8d073f87fdacaf9e93b616f5b84695036e3 Mon Sep 17 00:00:00 2001 +From: yangjiaqi +Date: Wed, 22 Mar 2023 15:31:34 +0800 +Subject: [PATCH] proc: fix /proc/diskstats output format + +--- + src/proc_fuse.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +diff --git a/src/proc_fuse.c b/src/proc_fuse.c +index fe81cad..ce22974 100644 +--- a/src/proc_fuse.c ++++ b/src/proc_fuse.c +@@ -784,10 +784,10 @@ static int proc_diskstats_read(char *buf, size_t size, off_t offset, + memset(lbuf, 0, 256); + if (stats.read || stats.write || stats.read_merged || stats.write_merged || + stats.read_sectors || stats.write_sectors || stats.read_ticks || +- stats.write_ticks || stats.ios_pgr || stats.total_ticks || stats.rq_ticks || ++ stats.write_ticks || stats.ios_pgr || stats.total_ticks || stats.rq_ticks || stats.discard || + stats.discard_merged || stats.discard_sectors || stats.discard_ticks) { + if (need_record_diskstats(stats.major, stats.minor)) { +- sscanf(line, "%u %u %71s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", ++ sscanf(line, "%u %u %71s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", + &stats.major, + &stats.minor, + tmp_dev_name, +@@ -802,11 +802,12 @@ static int proc_diskstats_read(char *buf, size_t size, off_t offset, + &stats.ios_pgr, + &stats.total_ticks, + &stats.rq_ticks, ++ &stats.discard, + &stats.discard_merged, + &stats.discard_sectors, + &stats.discard_ticks); + } +- snprintf(lbuf, 256, "%u %u %s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", ++ ret = snprintf(lbuf, 256, "%u %u %s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", + stats.major, + stats.minor, + stats.dev_name, +@@ -821,11 +822,17 @@ static int proc_diskstats_read(char *buf, size_t size, off_t offset, + stats.ios_pgr, + stats.total_ticks, + stats.rq_ticks, ++ stats.discard, + stats.discard_merged, + stats.discard_sectors, + stats.discard_ticks); ++ if(ret >= 256) { ++ lxcfs_error("Insufficient buffer for %u:%u %s diskstats", ++ stats.major, stats.minor, stats.dev_name); ++ continue; ++ } + } else if (need_record_diskstats(stats.major, stats.minor)) { +- sscanf(line, "%u %u %71s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", ++ sscanf(line, "%u %u %71s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", + &stats.major, + &stats.minor, + tmp_dev_name, +@@ -840,10 +847,11 @@ static int proc_diskstats_read(char *buf, size_t size, off_t offset, + &stats.ios_pgr, + &stats.total_ticks, + &stats.rq_ticks, ++ &stats.discard, + &stats.discard_merged, + &stats.discard_sectors, + &stats.discard_ticks); +- snprintf(lbuf, 256, "%u %u %s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", ++ ret = snprintf(lbuf, 256, "%u %u %s %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\n", + stats.major, + stats.minor, + stats.dev_name, +@@ -858,9 +866,15 @@ static int proc_diskstats_read(char *buf, size_t size, off_t offset, + stats.ios_pgr, + stats.total_ticks, + stats.rq_ticks, ++ stats.discard, + stats.discard_merged, + stats.discard_sectors, + stats.discard_ticks); ++ if(ret >= 256) { ++ lxcfs_error("Insufficient buffer for %u:%u %s diskstats", ++ stats.major, stats.minor, stats.dev_name); ++ continue; ++ } + } else { + continue; + } +-- +2.30.0 + diff --git a/lxcfs.spec b/lxcfs.spec index 870540663a8513b4c94ce0f1a1b5c52675f09068..6b3dbfa3b321da1b8d0f634e0d6bd38c1d71847a 100644 --- a/lxcfs.spec +++ b/lxcfs.spec @@ -4,7 +4,7 @@ #Basic Information Name: lxcfs Version: 4.0.11 -Release: 5 +Release: 8 Summary: FUSE filesystem for LXC License: LGPL 2.1+ URL: http://linuxcontainers.org @@ -31,6 +31,8 @@ Patch9018: 0018-fix-deadlock-problem-when-subprocess-exit.patch Patch9019: 0019-fix-dev-read-memory-leak-in-container.patch Patch9020: 0020-enable-cfs-option-to-show-correct-proc-cpuinfo-view.patch Patch9021: 0021-fix-pidfd_open-pidfd_send_signal-function-compilatio.patch +Patch9022: 0022-cpuview-fix-possible-use-after-free-in-find_proc_sta.patch +Patch9023: 0023-proc-fix-proc-diskstats-output-format.patch #Dependency BuildRequires: autoconf automake libtool help2man @@ -92,6 +94,21 @@ fi %{_unitdir}/* %changelog +* Wed Mar 22 2023 yangjiaqi - 4.0.11-8 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:fix /proc/diskstats output format + +* Wed Mar 22 2023 yangjiaqi - 4.0.11-7 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:fix possible use-after-free in find_proc_stat_node + +* Mon Dec 12 2022 yangjiaqi - 4.0.11-6 +- add yaml + * Thu Nov 24 2022 yangjiaqi - 4.0.11-5 - fix pidfd_open&pidfd_send_signal function compilation bug in glibc2.36+