From: Guan Jing guanjing6@huawei.com
hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZJI8 CVE: NA
-------------------------------
Allocate a new task_struct_resvd object for the recently cloned task
Signed-off-by: Zheng Zucheng zhengzucheng@huawei.com Signed-off-by: Guan Jing guanjing6@huawei.com --- include/linux/sched.h | 2 ++ init/init_task.c | 5 +++++ kernel/fork.c | 21 ++++++++++++++++++++- 3 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h index 1295dc3fe051..6fc6034765ae 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -769,6 +769,8 @@ struct kmap_ctrl { };
struct task_struct_resvd { + /* pointer back to the main task_struct */ + struct task_struct *task; };
struct task_struct { diff --git a/init/init_task.c b/init/init_task.c index 2101c6e3432d..ee1cdf5735e1 100644 --- a/init/init_task.c +++ b/init/init_task.c @@ -57,6 +57,10 @@ unsigned long init_shadow_call_stack[SCS_SIZE / sizeof(long)] }; #endif
+static struct task_struct_resvd init_task_struct_resvd = { + .task = &init_task, +}; + /* * Set up the first task table, touch at your own risk!. Base=0, * limit=0x1fffff (=2MB) @@ -216,6 +220,7 @@ struct task_struct init_task #ifdef CONFIG_BPF_SCHED .tag = 0, #endif + ._resvd = &init_task_struct_resvd, }; EXPORT_SYMBOL(init_task);
diff --git a/kernel/fork.c b/kernel/fork.c index fd0405523f07..00e5886c9e04 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -179,6 +179,7 @@ static inline struct task_struct *alloc_task_struct_node(int node)
static inline void free_task_struct(struct task_struct *tsk) { + kfree(tsk->_resvd); kmem_cache_free(task_struct_cachep, tsk); } #endif @@ -1112,6 +1113,18 @@ void set_task_stack_end_magic(struct task_struct *tsk) *stackend = STACK_END_MAGIC; /* for overflow detection */ }
+static bool dup_resvd_task_struct(struct task_struct *dst, + struct task_struct *orig, int node) +{ + dst->_resvd = kzalloc_node(sizeof(struct task_struct_resvd), + GFP_KERNEL, node); + if (!dst->_resvd) + return false; + + dst->_resvd->task = dst; + return true; +} + static struct task_struct *dup_task_struct(struct task_struct *orig, int node) { struct task_struct *tsk; @@ -1122,9 +1135,15 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) tsk = alloc_task_struct_node(node); if (!tsk) return NULL; + /* + * before proceeding, we need to make tsk->_resvd = NULL, + * otherwise the error paths below, if taken, might end up causing + * a double-free for task_struct_resvd extension object. + */ + WRITE_ONCE(tsk->_resvd, NULL);
err = arch_dup_task_struct(tsk, orig); - if (err) + if (err || !dup_resvd_task_struct(tsk, orig, node)) goto free_tsk;
err = alloc_thread_stack_node(tsk, node);