From 381235b9f2aa500b6e2971e98ea84edc107cd1d8 Mon Sep 17 00:00:00 2001 From: JP Kobryn Date: Mon, 14 Jul 2025 16:45:55 -0700 Subject: [PATCH] cgroup: make sure css_rstat_init() is called before css_rstat_exit() Test against syzbot repro. Signed-off-by: JP Kobryn --- kernel/cgroup/cgroup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index a723b7dc6e4e..e6c5c998ead6 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -5669,6 +5669,12 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp, init_and_link_css(css, ss, cgrp); + err = css_rstat_init(css); + if (err) { + ss->css_free(css); + goto err_out; + } + err = percpu_ref_init(&css->refcnt, css_release, 0, GFP_KERNEL); if (err) goto err_free_css; @@ -5678,10 +5684,6 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp, goto err_free_css; css->id = err; - err = css_rstat_init(css); - if (err) - goto err_free_css; - /* @css is ready to be brought online now, make it visible */ list_add_tail_rcu(&css->sibling, &parent_css->children); cgroup_idr_replace(&ss->css_idr, css, css->id); @@ -5697,6 +5699,7 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp, err_free_css: INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn); queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork); +err_out: return ERR_PTR(err); } -- 2.47.1