]> git.proxmox.com Git - mirror_lxcfs.git/commit
cpuview: fix possible use-after-free in find_proc_stat_node
authorAlexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Fri, 2 Dec 2022 11:57:33 +0000 (12:57 +0100)
committerAlexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
Fri, 2 Dec 2022 15:21:23 +0000 (16:21 +0100)
commit54db3e71b80fb8a25c9d6bd8ae9be0f0b4b41f26
tree86936f8458be3eb7296ad0a038ed836d1ff12e98
parent7a109f20df5f3e09cc7e2d03a8452129b8b8ca87
cpuview: fix possible use-after-free in find_proc_stat_node

Our current lock design uses 2 sync primitives.
First (pthread_rwlock) protects hash table buckets.
Second (pthread_mutex) protects each struct cg_proc_stat
from concurrent modification. But the problem is that function
find_proc_stat_node() can return a pointer to the node
(struct cg_proc_stat) which can be freed by prune_proc_stat_history()
call *before* we take pthread_mutex. Moreover, we perform
memory release of (struct cg_proc_stat) in prune_proc_stat_list()
without any protection like refcounter or mutex on (struct cg_proc_stat).

An attempt to guess what happens in:
https://github.com/lxc/lxcfs/issues/565
https://discuss.linuxcontainers.org/t/number-of-cpus-reported-by-proc-stat-fluctuates-causing-issues/15780/14

Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
src/proc_cpuview.c