3.4 KiB
CVE-2025-21634
Description
In the Linux kernel, the following vulnerability has been resolved:cgroup/cpuset: remove kernfs active breakA warning was found:WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: GRIP: 0010:kernfs_should_drain_open_files+0x1a1/0x1b0RSP: 0018:ffff8881107ef9e0 EFLAGS: 00010202RAX: 0000000080000002 RBX: ffff888154738c00 RCX: dffffc0000000000RDX: 0000000000000007 RSI: 0000000000000004 RDI: ffff888154738c04RBP: ffff888154738c04 R08: ffffffffaf27fa15 R09: ffffed102a8e7180R10: ffff888154738c07 R11: 0000000000000000 R12: ffff888154738c08R13: ffff888750f8c000 R14: ffff888750f8c0e8 R15: ffff888154738ca0FS: 00007f84cd0be740(0000) GS:ffff8887ddc00000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000555f9fbe00c8 CR3: 0000000153eec001 CR4: 0000000000370ee0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: kernfs_drain+0x15e/0x2f0 __kernfs_remove+0x165/0x300 kernfs_remove_by_name_ns+0x7b/0xc0 cgroup_rm_file+0x154/0x1c0 cgroup_addrm_files+0x1c2/0x1f0 css_clear_dir+0x77/0x110 kill_css+0x4c/0x1b0 cgroup_destroy_locked+0x194/0x380 cgroup_rmdir+0x2a/0x140It can be explained by:rmdir echo 1 > cpuset.cpus kernfs_fop_write_iter // active=0cgroup_rm_filekernfs_remove_by_name_ns kernfs_get_active // active=1__kernfs_remove // active=0x80000002kernfs_drain cpuset_write_resmaskwait_event//waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001// continue kernfs_unbreak_active_protection // active = 0x80000002...kernfs_should_drain_open_files// warning occurs kernfs_put_activeThis warning is caused by 'kernfs_break_active_protection' when it iswriting to cpuset.cpus, and the cgroup is removed concurrently.The commit 3a5a6d0c2b03 ("cpuset: don't nest cgroup_mutex insideget_online_cpus()") made cpuset_hotplug_workfn asynchronous, This changeinvolves calling flush_work(), which can create a multiple processescircular locking dependency that involve cgroup_mutex, potentially leadingto a deadlock. To avoid deadlock. the commit 76bb5ab8f6e3 ("cpuset: breakkernfs active protection in cpuset_write_resmask()") added'kernfs_break_active_protection' in the cpuset_write_resmask. This couldlead to this warning.After the commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplugprocessing synchronous"), the cpuset_write_resmask no longer needs towait the hotplug to finish, which means that concurrent hotplug and cpusetoperations are no longer possible. Therefore, the deadlock doesn't existanymore and it does not have to 'break active protection' now. To fix thiswarning, just remove kernfs_break_active_protection operation in the'cpuset_write_resmask'.
POC
Reference
No PoCs from references.