linux-kernel - Re: [PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in css_rstat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aJeXc2-GjqZI9I9F@slm.duckdns.org>
Date: Sat, 9 Aug 2025 08:46:11 -1000
From: Tejun Heo <tj@...nel.org>
To: JP Kobryn <inwardvessel@...il.com>
Cc: shakeel.butt@...ux.dev, mkoutny@...e.com, yosryahmed@...gle.com,
	hannes@...xchg.org, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, cgroups@...r.kernel.org,
	kernel-team@...a.com
Subject: Re: [PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in
 css_rstat_exit()

On Wed, Aug 06, 2025 at 05:33:50PM -0700, JP Kobryn wrote:
> css_rstat_exit() may be called asynchronously in scenarios where preceding
> calls to css_rstat_init() have not completed. One such example is this
> sequence below:
> 
> css_create(...)
> {
> 	...
> 	init_and_link_css(css, ...);
> 
> 	err = percpu_ref_init(...);
> 	if (err)
> 		goto err_free_css;
> 	err = cgroup_idr_alloc(...);
> 	if (err)
> 		goto err_free_css;
> 	err = css_rstat_init(css, ...);
> 	if (err)
> 		goto err_free_css;
> 	...
> err_free_css:
> 	INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
> 	queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
> 	return ERR_PTR(err);
> }
> 
> If any of the three goto jumps are taken, async cleanup will begin and
> css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
> 
> Avoid accessing the unitialized field by returning early in
> css_rstat_exit() if this is the case.
> 
> Signed-off-by: JP Kobryn <inwardvessel@...il.com>
> Suggested-by: Michal Koutný <mkoutny@...e.com>
> Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
> Reported-by: syzbot+8d052e8b99e40bc625ed@...kaller.appspotmail.com
> Acked-by: Shakeel Butt <shakeel.butt@...ux.dev>

Applied to cgroup/for-6.17-fixes.

Thanks.

-- 
tejun