CVE-2012-1146: Null Pointer Dereference

The memcgroupusageunregisterevent function in mm/memcontrol.c in the Linux kernel before 3.2.10 does not properly handle multiple events that are attached to the same eventfd, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by registering memory threshold events.

— Launchpad

There is an issue when memcg unregisters events that were attached to the same eventfd:

- On the first call memcgroupusageunregisterevent() removes all events attached to a given eventfd, and if there were no events left, thresholds->primary would become NULL;

- Since there were several events registered, cgroups core will call memcgroupusageunregisterevent() again, but now kernel will oops, as the function doesn't expect that threshold->primary may be NULL.

FWIW, w/o the patch the following oops may be observed:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [<ffffffff810be32c>] memcgroupusageunregisterevent+0x9c/0x1f0 Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs RIP: 0010:[<ffffffff810be32c>] [<ffffffff810be32c>] memcgroupusageunregisterevent+0x9c/0x1f0 RSP: 0018:ffff88001d0b9d60 EFLAGS: 00010246 Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0) Call Trace: [<ffffffff8107092b>] cgroupeventremove+0x2b/0x60 [<ffffffff8103db94>] processonework+0x174/0x450 [<ffffffff8103e413>] workerthread+0x123/0x2d0

A local attacker able to register threshold events could use this flaw to crash the system.

Upstream commit: http://git.kernel.org/linus/371528c

— Red Hat