63 lines
1.7 KiB
Diff
63 lines
1.7 KiB
Diff
From 76511b0ae1da7f401fe06c8b4dd18a40c3a2b52b Mon Sep 17 00:00:00 2001
|
|
From: JP Kobryn <inwardvessel@gmail.com>
|
|
Date: Wed, 6 Aug 2025 17:33:50 -0700
|
|
Subject: cgroup: avoid null de-ref in css_rstat_exit()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
css_rstat_exit() may be called asynchronously in scenarios where preceding
|
|
calls to css_rstat_init() have not completed. One such example is this
|
|
sequence below:
|
|
|
|
css_create(...)
|
|
{
|
|
...
|
|
init_and_link_css(css, ...);
|
|
|
|
err = percpu_ref_init(...);
|
|
if (err)
|
|
goto err_free_css;
|
|
err = cgroup_idr_alloc(...);
|
|
if (err)
|
|
goto err_free_css;
|
|
err = css_rstat_init(css, ...);
|
|
if (err)
|
|
goto err_free_css;
|
|
...
|
|
err_free_css:
|
|
INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
|
|
queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
If any of the three goto jumps are taken, async cleanup will begin and
|
|
css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
|
|
|
|
Avoid accessing the unitialized field by returning early in
|
|
css_rstat_exit() if this is the case.
|
|
|
|
Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
|
|
Suggested-by: Michal Koutný <mkoutny@suse.com>
|
|
Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
|
|
Cc: stable@vger.kernel.org # v6.16
|
|
Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com
|
|
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
|
|
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
---
|
|
kernel/cgroup/rstat.c | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
--- a/kernel/cgroup/rstat.c
|
|
+++ b/kernel/cgroup/rstat.c
|
|
@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys
|
|
if (!css_uses_rstat(css))
|
|
return;
|
|
|
|
+ if (!css->rstat_cpu)
|
|
+ return;
|
|
+
|
|
css_rstat_flush(css);
|
|
|
|
/* sanity check */
|