From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-87.mail.qq.com (out162-62-57-87.mail.qq.com [162.62.57.87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3712737F759 for ; Fri, 10 Apr 2026 10:49:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.87 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775818161; cv=none; b=JyH9DJOohcrLUlLMAga84+QgmpwGUnMFduots/bgWhy5OaVEaYgWUxtnkkqhL1+GM+UklaKUp6bc0rmr00fkZdVZBmTNQzY6nDtQJBoLzzJKzPf/Lev/8J545ASdgRUGw+EKedDH+K/i3HUvbKBmqsAOCB0Qky8bEznJT3zgRMc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775818161; c=relaxed/simple; bh=aUXRXwx5wmld6QJxsG7W9Fs6+05ag3RSo8bdWOrvC0k=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=YIG4X7n0i3gFBKRcKEUMj8ZNQbT1xwPd5C6fkaO8TTFDSc3QYJe7ooL6HWkybS5NsJUmFM0L3fyfOHaeduKtLDEDhgFkyr7xeF6Ee5KmibFuCEI0bIiopj2euJ9qjTbYbYA3nx4teQB0sK4R1uu5HbshzTek+t8MQ11czPO4+Fw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=CyZwM1kA; arc=none smtp.client-ip=162.62.57.87 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="CyZwM1kA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1775818155; bh=Xu2/AZlq6L/4n/2iZ13pT/SFRnQ+/Dw4GdBmS7zRtws=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CyZwM1kANMtEC4QEbo13vT6lkcJFthfqwoHT1Bc6SH85W47cpDPc3WnNmCmQ4hTjq 0+phE8lhW1XUeaoXyjz5hkyagPYtOts6stuhniJ6UcIIcq+F5wD350iLXW6plCHvHw dQZILbbMji7Z3G+cb52ps1n4VPMKmtvDEj9PTc10= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id C04264BA; Fri, 10 Apr 2026 18:48:04 +0800 X-QQ-mid: xmsmtpt1775818084tlp6f4fb3 Message-ID: X-QQ-XMAILINFO: OE5mCIIf2ynQ9uKmZjzrMwJOef3RSsR1McQFFjO4Zphm3hD0GP/LEqrNRmRqU0 ej3KKlTvlUtUgVsti15wU/UqynjDRvRjtLvTGp36+JRvzmpjQY+HKwqrcvwbV9ABUVNx4PluQsmg IcI782Lg6k9N609naENbfjOPcxoxkPjlBUnBDnNh2ZgE/W3x1/1ID/VqLrFc78zj84ebWETuV0Fw HyJacSsFCTAEU5NraM8BvlF/7DPfLhFyshYSbfn2dtAG+DUQYm/C6HAmdSXldHI4vDx+L7FliHZ8 rXj6U+67dlPYhRqvOGXDjZ5m7BubYUB29SuYOweHnfbzX47vxl3MRC3zfvAHkv+K+s+UmcoXKuzw vBmcphB7URHe1Dn4OYSR+z3jrFprVj905rev+8wFh668sXxRzw4SF1shsSYftPnxDL6voWmODbw+ eVAEYgfEV7ZLShNJXueK89nTSdT/98jHgEaG2+8ufW9DYk/0uQUeUTS1FeRH2pJT0NgidQ58IuQQ 9iBV29eX+zE1mCqeNrcW1WPGSomJhOtWXaMZ13WJndt9Q0l56yFTR1odxgEc8h2DPIwU/PMr/tkv EVg8M55jgqIpFxafS6JN4BfGKX69G3k6dvTguwdrvFvK50EUFApijfchfa9WqY4BTcNlChCqzGUN DppzkNJAkYTpptAzD9HoWsNquwArhA/Kt3f36983JEn9C682L/zZrR/mzTqZcD4LhxhGmrRtK/LG mvVPNmmtjbxIsJa5Sdpy+15niiElP4uGnoXMig1E+4VB3tmBchDvfxL/ADlerWD9y0X3qyRI1UgW H281SAzFFn+cTG9TpGOV5oxTPTltCOuUVbYAPR4V5jD5JPMLquNApbBLIWYv1daOb9TkUwAezT+E K8i+PakJ8N1LIZK7SJfoXtsLZTMIVW4g+mCLB3eyMCyGS5lLBeY+KvaLrX7A+KxumS0TDgfR3/NH d81lj21efbp0YQY0XyMfD8lYpBdUq/59z/ci3r4tSFfxI7TpkFrC7OQ3k53IIPQ4gtqOfUOewfyj +6dJo43jpne4Aa+Hl7Vg5iNIxZPv84uhpKQd4UdA== X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== From: Edward Adam Davis To: syzbot+33e571025d88efd1312c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write Date: Fri, 10 Apr 2026 18:48:04 +0800 X-OQ-MSGID: <20260410104803.143594-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69d779b0.a00a0220.468cb.0018.GAE@google.com> References: <69d779b0.a00a0220.468cb.0018.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4ca3cb993da2..3de07258f57d 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -3995,7 +3995,7 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, size_t nbytes, enum psi_res res) { - struct cgroup_file_ctx *ctx = of->priv; + struct cgroup_file_ctx *ctx; struct psi_trigger *new; struct cgroup *cgrp; struct psi_group *psi; @@ -4004,12 +4004,18 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, if (!cgrp) return -ENODEV; + ctx = of->priv; + if (!ctx) { + cgroup_kn_unlock(of->kn); + return -ENODEV; + } + cgroup_get(cgrp); - cgroup_kn_unlock(of->kn); /* Allow only one trigger per file descriptor */ if (ctx->psi.trigger) { cgroup_put(cgrp); + cgroup_kn_unlock(of->kn); return -EBUSY; } @@ -4017,12 +4023,14 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, new = psi_trigger_create(psi, buf, res, of->file, of); if (IS_ERR(new)) { cgroup_put(cgrp); + cgroup_kn_unlock(of->kn); return PTR_ERR(new); } smp_store_release(&ctx->psi.trigger, new); cgroup_put(cgrp); + cgroup_kn_unlock(of->kn); return nbytes; } --