From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from xmbghk7.mail.qq.com (xmbghk7.mail.qq.com [43.163.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D792833FE26 for ; Fri, 10 Apr 2026 12:13:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=43.163.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775823231; cv=none; b=g9CRTHq68yr/ZEw1VhVQRzPGqRMfkU0njWJPf7a5o0BPfm636nAGENoVEFL8ZHvx/hB1Glkufx9S86/OFViZ9XlEaz2xxn8BrKOO53Tw9DNUQ4t3RS4HK85buGn5VEawwJamG5+Cg9xjKWYCBYwMqVOqIfMzr/sE4gx/4GqyROk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775823231; c=relaxed/simple; bh=xl4TQl+Nbsrb/+zfUDxGevLsPmtHS+of5bDDzyjPFQ0=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=p2bwgPhlMJ1dnVZZdAU4mA473QlUR5ElRMevUVIQb7bAh/cTEwxx2iIfWzGnFaKWUqpWoC+GvoHW/xm4ZwDSv3VvU9EgYdVmvum7ynu9FHuYEjE8cDqhKretkLBrWy/R/OU1xzKxtiGt5NpsvqZmObXJ2OKXlDG/Bpm1wuHgWf4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=E9sQpZZF; arc=none smtp.client-ip=43.163.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="E9sQpZZF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1775823219; bh=sK5579kiU0+2rrBYMqZKU/bkXdrmH9OxB75Y3ObYclI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=E9sQpZZFtLw9L5QLs76piTfK//flZDzf0GBf6W3Cr3bXjBdo3NkMi9cLM1fYJ8dtA 003+Zc86S+NxvPpk74DuhS/fvqfYNtC6CRZG+UwyyHpsbZDGmV7U0rmarddMS2bQNs qRe+wTbm4lCmFgEcEXgJAq0dEg1LaeQbLD3ZBLEI= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id 36535053; Fri, 10 Apr 2026 20:13:37 +0800 X-QQ-mid: xmsmtpt1775823217tmmnnrih0 Message-ID: X-QQ-XMAILINFO: NC4p7XQIBeahMEA0KL3z0O8U73PPvWB7PJWcJmN8vuTAsY7V29uIrkTay9RpA8 9vA8IsrTAhQgaltocRusDJfk5/SBI53NCasxrONFdu31BFIPn8DOnfJc+4T4rf86BH/IVPxCYNR1 Y71QF2JeZzcjA7x4Roid/1BllDZFhV5dNKCj77EKgwrVZDCSY54xaxpqo+ILdTVfc9hxeHmSTmqX sbgarYUV87/Cp2iXxmvzT7npdgbup7w6nmMLHUvkR5bp8xouIntbmXIr8AYbbhuxMXKjRJp6aodY XdPHUQs4Md/q4ccyiAZwA0r+k6LsSho1G8YOqvYtT/96KEesDEP1oy/hG76U/86QMljmHbocMrVj LxYneP0M4pGDVrmVPQHvpiMT+VX9cyr8RPiuISDzN6ZAp0UvfkZAp4xfkljViZzoZdmzokSiAKxx d4HHvltfbOyj7N2UhtrmAYR+BoQE/p6IbYuEJcP+A+VlP+ki0g7SiDofe4xmsGUgVXTwnlJHWV+O BHipZMwTqgdNnnFMBGFtOWr7rXWk05bn4Wz2MYE8Pk1JQyU5v4KaNM4+dXA8pQ/sS25QRE/UYshx QFteGej0AjnN+oj8sR5fotFMJAFqk7fy1uXDDxuQ7++rn1kloVWcvd3f9YhAtNZSDMQ80LgiyNtK RhekUC1nO4m+VHbZiJeZz3ur2uxHd4VmP37ndr5xBcpdJmst99imAoQUIj952vCsDwA8FnkXV+i4 qNjPCu+H1RHEbHKnqrS62baDEQQFXi5ZdV1ZrWwYGTFBY2IEyCnRqqheefTuSEKHvImm6U1tGoTo 3y56M/EnTXmQ4NY52LjP67k3X/n7VjC9/ACUEiF9JWTuvtD0pRkWgZlzYgIqS/NKm45mBzh+HJIA vf3HlphFLKr51c5zv/9D/wzUO6aOhS32VEnRGC4cyxU+wVU4K5Wa3MQD3lGuvw0mIJczt8o7Ee6X 8z7FpHzg0zWZwag5Dur7ubyPdOEICNskRIcBrxXE8CTpQ6Rv25ncRaJEr+NifnSVtthm79HU1PfK q6/V4fsg== X-QQ-XMRINFO: OWPUhxQsoeAVwkVaQIEGSKwwgKCxK/fD5g== From: Edward Adam Davis To: syzbot+33e571025d88efd1312c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write Date: Fri, 10 Apr 2026 20:13:37 +0800 X-OQ-MSGID: <20260410121336.148710-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69d779b0.a00a0220.468cb.0018.GAE@google.com> References: <69d779b0.a00a0220.468cb.0018.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4ca3cb993da2..46db30de817b 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -3995,34 +3995,47 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, size_t nbytes, enum psi_res res) { - struct cgroup_file_ctx *ctx = of->priv; + struct cgroup_file_ctx *ctx; struct psi_trigger *new; struct cgroup *cgrp; struct psi_group *psi; + ssize_t ret = 0; cgrp = cgroup_kn_lock_live(of->kn, false); if (!cgrp) return -ENODEV; + ctx = of->priv; + if (!ctx) { + ret = -ENODEV; + goto out_unlock; + } + cgroup_get(cgrp); - cgroup_kn_unlock(of->kn); /* Allow only one trigger per file descriptor */ if (ctx->psi.trigger) { cgroup_put(cgrp); - return -EBUSY; + ret = -EBUSY; + goto out_unlock; } psi = cgroup_psi(cgrp); new = psi_trigger_create(psi, buf, res, of->file, of); if (IS_ERR(new)) { cgroup_put(cgrp); - return PTR_ERR(new); + ret = PTR_ERR(new); + goto out_unlock; } smp_store_release(&ctx->psi.trigger, new); cgroup_put(cgrp); +out_unlock: + cgroup_kn_unlock(of->kn); + if (ret) + return ret; + return nbytes; }