From d5a04e338eef531108e9f6266e67e09f63ae4155 Mon Sep 17 00:00:00 2001 From: Rahat Mahmood Date: Thu, 16 Jun 2022 13:54:09 -0700 Subject: [PATCH] cgroupfs: Don't copy in with cgroups locks held. CopyIn acquires mm.mappingMu, which is ordered before cgroups locks. Reported-by: syzbot+97a5960840a8aeb25e6a@syzkaller.appspotmail.com PiperOrigin-RevId: 455460140 --- pkg/sentry/fsimpl/cgroupfs/pids.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/sentry/fsimpl/cgroupfs/pids.go b/pkg/sentry/fsimpl/cgroupfs/pids.go index ea17a45fd..29aa491f8 100644 --- a/pkg/sentry/fsimpl/cgroupfs/pids.go +++ b/pkg/sentry/fsimpl/cgroupfs/pids.go @@ -268,9 +268,6 @@ func (d *pidsMaxData) Generate(ctx context.Context, buf *bytes.Buffer) error { // Write implements vfs.WritableDynamicBytesSource.Write. func (d *pidsMaxData) Write(ctx context.Context, _ *vfs.FileDescription, src usermem.IOSequence, offset int64) (int64, error) { - d.c.mu.Lock() - defer d.c.mu.Unlock() - t := kernel.TaskFromContext(ctx) buf := t.CopyScratchBuffer(hostarch.PageSize) ncpy, err := src.CopyIn(ctx, buf) @@ -278,6 +275,8 @@ func (d *pidsMaxData) Write(ctx context.Context, _ *vfs.FileDescription, src use return 0, err } if strings.TrimSpace(string(buf)) == "max" { + d.c.mu.Lock() + defer d.c.mu.Unlock() d.c.max = pidLimitUnlimited return int64(ncpy), nil } @@ -290,6 +289,8 @@ func (d *pidsMaxData) Write(ctx context.Context, _ *vfs.FileDescription, src use return 0, linuxerr.EINVAL } + d.c.mu.Lock() + defer d.c.mu.Unlock() d.c.max = val return int64(n), nil }