[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20250807003350.178160-1-inwardvessel@gmail.com>
Date: Wed, 6 Aug 2025 17:33:50 -0700
From: JP Kobryn <inwardvessel@...il.com>
To: tj@...nel.org,
shakeel.butt@...ux.dev,
mkoutny@...e.com,
yosryahmed@...gle.com,
hannes@...xchg.org,
akpm@...ux-foundation.org
Cc: linux-kernel@...r.kernel.org,
cgroups@...r.kernel.org,
kernel-team@...a.com
Subject: [PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in css_rstat_exit()
css_rstat_exit() may be called asynchronously in scenarios where preceding
calls to css_rstat_init() have not completed. One such example is this
sequence below:
css_create(...)
{
...
init_and_link_css(css, ...);
err = percpu_ref_init(...);
if (err)
goto err_free_css;
err = cgroup_idr_alloc(...);
if (err)
goto err_free_css;
err = css_rstat_init(css, ...);
if (err)
goto err_free_css;
...
err_free_css:
INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
return ERR_PTR(err);
}
If any of the three goto jumps are taken, async cleanup will begin and
css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
Avoid accessing the unitialized field by returning early in
css_rstat_exit() if this is the case.
Signed-off-by: JP Kobryn <inwardvessel@...il.com>
Suggested-by: Michal Koutný <mkoutny@...e.com>
Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
Reported-by: syzbot+8d052e8b99e40bc625ed@...kaller.appspotmail.com
Acked-by: Shakeel Butt <shakeel.butt@...ux.dev>
---
kernel/cgroup/rstat.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index cbeaa499a96a..408e52d5f7a4 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys_state *css)
if (!css_uses_rstat(css))
return;
+ if (!css->rstat_cpu)
+ return;
+
css_rstat_flush(css);
/* sanity check */
--
2.47.3
Powered by blists - more mailing lists