From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f180.google.com (mail-oi1-f180.google.com [209.85.167.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30E9F2C859 for ; Tue, 3 Feb 2026 14:46:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770129986; cv=none; b=F5/JAnBpuYIeU0ywRM/qrtUS5xwnD0Ax2Ej/bi+wT8QuHX7pefUj+D4AFBKi8xscWmcdsmvWHvBuOMS5LTL2D1U1fWWbhzSabP6TyX65KrJvnwiRXZFhFj83ZtgCs8ORzI5FLLv9L9wcx/4UmrSDoVRXlArkT2pSxmQFCaDjIVo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770129986; c=relaxed/simple; bh=MAFQ5WMv7g5W0wOxe78cTJkvFbcpcxg6XzjQZ0plQGk=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=fgdWJWAP79qQe0K578kAYLiONupMqCgzBJCKMAFS6dFZfV/6/bGfFeusmm7HvtrJ3hnMe3xxGBXt1dn+LDU34OJC/tkptLFNRo+vR7K7BSWRXcTWScXVyKlCza4SlNBTiQc09ooX1Mrk6jbUlEnuqwxlgGdiXtPfhBbom7sqFPs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.dk; spf=pass smtp.mailfrom=kernel.dk; dkim=pass (2048-bit key) header.d=kernel-dk.20230601.gappssmtp.com header.i=@kernel-dk.20230601.gappssmtp.com header.b=Us9E4mi9; arc=none smtp.client-ip=209.85.167.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.dk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kernel.dk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel-dk.20230601.gappssmtp.com header.i=@kernel-dk.20230601.gappssmtp.com header.b="Us9E4mi9" Received: by mail-oi1-f180.google.com with SMTP id 5614622812f47-45c838069e5so3888937b6e.0 for ; Tue, 03 Feb 2026 06:46:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel-dk.20230601.gappssmtp.com; s=20230601; t=1770129982; x=1770734782; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=h8h3ESOfLmEqhgP4IZ+IYjjxYQsHrPxJrChAZKxI144=; b=Us9E4mi9jFMoqA0S8SMHFYNTZvhJeod7qw08PIuv185rTJHlmuqBPqZO/ZLoTOVKRt F+EL0Rxp4FdF3QhOusGdCE05bQQKLoRDGm39ALJiU1TIfRrs5ccnRErwaXeYqG2FZ3Xy sSsj1YHrXgv9nlgazkLCA6XJbFcwzOCK2DWuzkvoN3VMPSyLMYIygwxDNoUT8oLP6zIm nR1y6+Km4txn1UVchrf/LLhF5Ejck89FYcjBdEc6LUF7kIO47zAWiKw25tUzZnWh0yUc MUSlXwyvDN7eqydGAnyId5VQ9Vk+fQWQ5MqycdOBM/oAkCnrVPmf3KMt1ndMWxY5skLp KYXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770129982; x=1770734782; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=h8h3ESOfLmEqhgP4IZ+IYjjxYQsHrPxJrChAZKxI144=; b=koQZ1cCjEdmGGR/oLJT0v1xEu9jwM7BebpFSNwr9rd5eG4jl9NnD1Fo/qCJ/rFcYU3 SUGkSVxC1ri00YBzbO2/AAeXrPwnQGLeHA9Rf4RlLiJRAZFX+jHok2pIBNpBGtlICL5D eiKB6g1oaqM1GkBdSc3rBgjVxUhcEsUxIIMKnb80WX3MJMG9ARhfiWwYHpbAUOPz4gWq q/n2ekVrvkiymrd6pDJKqpmGQapN1xZF09MB9X8sJIaIretgsWS0zCj2G69iIyWFiKwq yk9Qxr8dCH7ib8meIqANRI+QGEJNyZ1Ypnypqhz0foPKhl1Jow3l7lwwqbdlb6ENerRc yDCw== X-Forwarded-Encrypted: i=1; AJvYcCXihip6U8+asyy18axy3tIFTjR3onPUjKzigZehK/JYm9MaRqBNgIFqLCBquNOp/7YUGnrY2bATi9VxTPI=@vger.kernel.org X-Gm-Message-State: AOJu0YwAFa1WihLiTlgAxkk79Y+DjzJ/yDfBXOzxAFBGzq1hLHJsmKJ/ eYy/Yi+gmQavv6yOuw7RtPq5dgdTRCdrrOTeJY70z7GiGyH9B8xPss/oLAt+KZ++Evo= X-Gm-Gg: AZuq6aKc5eNw7ub7d/BwOivlPJdApL8j6YnP3O7jdjLokJGGEKOdKWNjsuKyLyjhpKS bcZbrT6ROOhdcWBuakNVk1VQ6pmZUyvexDb/1k0U3cVxcwtl+JnzVh9o9vdsSQneartMKzPZk7Y tTLwB0x5zQ6PSnCWuE4M7v7sxn2y05Q8tjVfelF9ccSqT/no5UpMbU8v95le7/cdpNulfgmBGSc zP57Nsx2WTDbce4kaGpoiOP922v7oSwCLOb/5LRhLIQfPpQi/NGqDk2YqqmiQm30ZvUrRbSEqdo J+FTlohuudIYFCq9e6JKXEce+ypRrzoNbmH1ztdgs7OZY0irUmHRAjxIri36tiKDk1qk7TOS6xt fmoF5X++MxCoQBkhVvFgTDziX80/Uo8dV/og5lK0C/0YEQNewz2pFRX66H0lro+QyTnbDsRCYTP JJEbspPaSxQEl82YdRTo0GTqsueSxL4mAkZKrSHg9IXPJDChKNphA4qj4098x/Tbv+9co7bw== X-Received: by 2002:a05:6808:1596:b0:459:a26c:2c3c with SMTP id 5614622812f47-45f34b9d012mr7359494b6e.26.1770129982125; Tue, 03 Feb 2026 06:46:22 -0800 (PST) Received: from [192.168.1.150] ([198.8.77.157]) by smtp.gmail.com with ESMTPSA id 5614622812f47-45f08f20e38sm11231499b6e.10.2026.02.03.06.46.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 03 Feb 2026 06:46:21 -0800 (PST) Message-ID: <00babfab-5bd7-4b66-a765-f7c6689543c7@kernel.dk> Date: Tue, 3 Feb 2026 07:46:20 -0700 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [Kernel Bug] KASAN: slab-use-after-free Read in __blkcg_rstat_flush To: Ming Lei , =?UTF-8?Q?Michal_Koutn=C3=BD?= Cc: =?UTF-8?B?5p2O6b6Z5YW0?= , syzkaller@googlegroups.com, tj@kernel.org, josef@toxicpanda.com, cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, yukuai@fnnas.com References: <74zggmy53vzdb2q7sidvasnnlih5d5b4rp6jb6ibpka5zg7z7x@enl7iqw4prji> Content-Language: en-US From: Jens Axboe In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 2/3/26 7:40 AM, Ming Lei wrote: > On Tue, Feb 03, 2026 at 03:16:43PM +0100, Michal Koutný wrote: >> On Tue, Feb 03, 2026 at 10:08:07PM +0800, Ming Lei wrote: >>> I can't parse your question, here blkg_release() simply needs to flush >>> all stats. Why do you talk about preventing new flush? why is it related >>> with this UAF? >> >> What prevents this fix: >> >> --- a/block/blk-cgroup.c >> +++ b/block/blk-cgroup.c >> @@ -169,14 +169,6 @@ static void __blkg_release(struct rcu_head *rcu) >> #ifdef CONFIG_BLK_CGROUP_PUNT_BIO >> WARN_ON(!bio_list_empty(&blkg->async_bios)); >> #endif >> - /* >> - * Flush all the non-empty percpu lockless lists before releasing >> - * us, given these stat belongs to us. >> - * >> - * blkg_stat_lock is for serializing blkg stat update >> - */ >> - for_each_possible_cpu(cpu) >> - __blkcg_rstat_flush(blkcg, cpu); >> >> /* release the blkcg and parent blkg refs this blkg has been holding */ >> css_put(&blkg->blkcg->css); >> @@ -195,6 +187,15 @@ static void blkg_release(struct percpu_ref *ref) >> { >> struct blkcg_gq *blkg = container_of(ref, struct blkcg_gq, refcnt); >> >> + /* >> + * Flush all the non-empty percpu lockless lists before releasing >> + * us, given these stat belongs to us. >> + * >> + * blkg_stat_lock is for serializing blkg stat update >> + */ >> + for_each_possible_cpu(cpu) >> + __blkcg_rstat_flush(blkcg, cpu); >> + >> call_rcu(&blkg->rcu_head, __blkg_release); >> } > > This one looks more clever, can you send one formal patch? I'll drop the previous one for now - I didn't really mind it, but if we can fix it without, then yeah agree that's better. -- Jens Axboe