linux-kernel - Re: [PATCH 6.12.y] cgroup: Fix kernfs_node UAF in css_free_rwork

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CABdmKX3rhV-Kn7fMg689Yo2M3f88xS5BxK+5R6G0-rEx9thBOA@mail.gmail.com>
Date: Thu, 29 Jan 2026 11:11:48 -0800
From: "T.J. Mercier" <tjmercier@...gle.com>
To: stable@...r.kernel.org, tj@...nel.org, hannes@...xchg.org, 
	mkoutny@...e.com, cgroups@...r.kernel.org, hawk@...nel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6.12.y] cgroup: Fix kernfs_node UAF in css_free_rwork_fn

On Thu, Jan 29, 2026 at 11:10 AM T.J. Mercier <tjmercier@...gle.com> wrote:
>
> This fix patch is not upstream, and is applicable only to kernels 6.10
> (where the cgroup_rstat_lock tracepoint was added) through 6.15 after
> which commit 5da3bfa029d6 ("cgroup: use separate rstat trees for each
> subsystem") reordered cgroup_rstat_flush as part of a new feature
> addition and inadvertently fixed this UAF.

I am proposing we apply this one-off patch to stable rather than
backporting 5da3bfa029d6 ("cgroup: use separate rstat trees for each
subsystem") and its fixes to 6.12.y.

Cgroups folks, please let me know your thoughts.

>  kernel/cgroup/cgroup.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
> index b8cde3d1cb7b..cb756ee15b6f 100644
> --- a/kernel/cgroup/cgroup.c
> +++ b/kernel/cgroup/cgroup.c
> @@ -5481,9 +5481,9 @@ static void css_free_rwork_fn(struct work_struct *work)
>                          * children.
>                          */
>                         cgroup_put(cgroup_parent(cgrp));
> -                       kernfs_put(cgrp->kn);
>                         psi_cgroup_free(cgrp);
>                         cgroup_rstat_exit(cgrp);
> +                       kernfs_put(cgrp->kn);
>                         kfree(cgrp);
>                 } else {
>                         /*
>
> base-commit: abf529abd660d8ccad46dd8c8f20e93db6134f5f
> --
> 2.53.0.rc1.225.gd81095ad13-goog
>