From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from r3-20.sinamail.sina.com.cn (r3-20.sinamail.sina.com.cn [202.108.3.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2A13226D02 for ; Fri, 10 Apr 2026 04:01:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.108.3.20 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775793666; cv=none; b=BdpQbHD80/WcrWFSQhl822c8D5R3kqruaLeG2FenO8/sv/I1euic8m0VMie4d5dk+ni7aaa5qDBT5Qzo5oK9Jm9XHA4/PIM0NNyZGeH0nXUcaNT+SDdWt51KYIKc8FMAL5pOdCDIX+hS+ZwcvVpNNlE2/jxPyFoE6XdUhI9ykII= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775793666; c=relaxed/simple; bh=pztXVTV+lM+Nrw5Fey1n7GORwMVW0iePH9VQlKUAkas=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GUs5AMpF8uRXcNZEkngPVLNoWay2VT4qPPvtopiiJoUPzAvtI/iBuG7LmENU6tyYoWFyiUPWwlZjtW4N1JfqSpcWlKkZil0Lc4CEXavD/mTdgXmQArYxIR9bVdQHMbCaDVBgHknQLPouH7bkrKPZLFsEd/h2JoGK96ftOuwk0fw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=jIo1PWFD; arc=none smtp.client-ip=202.108.3.20 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="jIo1PWFD" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1775793662; bh=ivtDaLwZoVB9iJwZBk6fYnyWSP4/3mu/81mPaZd2HTI=; h=From:Subject:Date:Message-ID; b=jIo1PWFDYcUZpJXGzK/MgHWT0iUR5b1iDFBVB3fOnB3icgSmKbJABksv4Og+jvx+o J7lIlQC6U/CkzlVzCMTOHNJKbaU4slMZN6JX2Q5f8umcnWi13uHOAcJZWuZ/oh4C58 qj6RJGZ2h4tmnu6WLXwktF2g8a/svNUJ0AU55QqM= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([114.249.62.144]) by sina.com (10.54.253.32) with ESMTP id 69D875CD0000088E; Fri, 10 Apr 2026 12:00:16 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 9580294456655 X-SMAIL-UIID: 0CDD6053CBFC4901BEC640F7A7B6BCAB-20260410-120016-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write Date: Fri, 10 Apr 2026 12:00:01 +0800 Message-ID: <20260410040003.1666-1-hdanton@sina.com> In-Reply-To: <69d779b0.a00a0220.468cb.0018.GAE@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit > Date: Thu, 09 Apr 2026 03:04:32 -0700 [thread overview] > Hello, > > syzbot found the following issue on: > > HEAD commit: 591cd656a1bf Linux 7.0-rc7 > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=114a36ba580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=45cb3c58fd963c27 > dashboard link: https://syzkaller.appspot.com/bug?extid=33e571025d88efd1312c > compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16cb33da580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12648bd6580000 #syz test --- x/fs/kernfs/file.c +++ y/fs/kernfs/file.c @@ -756,6 +756,7 @@ static void kernfs_release_file(struct k lockdep_assert_held(kernfs_open_file_mutex_ptr(kn)); if (!of->released) { + mutex_lock(&of->mutex); /* * A file is never detached without being released and we * need to be able to release files which are deactivated @@ -764,6 +765,7 @@ static void kernfs_release_file(struct k kn->attr.ops->release(of); of->released = true; of_on(of)->nr_to_release--; + mutex_unlock(&of->mutex); } } --