From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-58-216.mail.qq.com (out162-62-58-216.mail.qq.com [162.62.58.216]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8568F3164DF for ; Fri, 10 Apr 2026 00:56:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.58.216 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775782597; cv=none; b=CjkfMgatHwtQmdt4FOmZ8MlMEV5UVVejDTNyPJc5D3pucdCa3OkAsuLDs2cSZ+tJJysdlTPDjPVxNQhEtG5+eEI4KwGkPoMiG+hssFtUhl8QlYRfyshgSuVMwaz+IuW4n1x3/dutJAlVDFU2mRjzdHGEYLFNW41sAedugroiTL0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775782597; c=relaxed/simple; bh=z3tiMBKhzUWxHH735933UuxaRu6ts1wxO4+zYX+d76c=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=cAUcIIfQ7fMCpKdtPKeumOa5rcC4JMNjsFvw3jTkI8LUfB1WqbvkeYLlHSwhPphek9bpJpDJwAJQpHQbpWciy1JINRPmRUBF74gMRFKlzvCCPl+cb8wMsEdgpV80rUpeglCyrl8kDyGO+8vJfCN/a01hlDaRVKxlKnxGD2/OiRI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=ZM9XNHy2; arc=none smtp.client-ip=162.62.58.216 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="ZM9XNHy2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1775782590; bh=LPglMM41LIv5HmPLkarwheNxc7nIfRyhCimzrmyDXEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ZM9XNHy2HtQC6202aahjbI7rIkryFa6OUqJiTEFTUduzNwvHCYgBr4Wa4XAm2l8Td 2i167KQsf7xe7NtjEoQPBWs9GD7Px1J9HzDjzJ1tSHWsFVQVzxRfz4CM+ZQxFHaPXd VKXhoq6XtfV7xFEU0GvXMMrnOV7UkdfXNpj8m+qs= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id E1BB6EE3; Fri, 10 Apr 2026 08:56:27 +0800 X-QQ-mid: xmsmtpt1775782587tasxd7ly1 Message-ID: X-QQ-XMAILINFO: M2SvzgchpLqf6tqgcVDzXx6BCuJ+JYi/m6W52Hw/JKeJgNnZOyqvppHMPHhRVd e9riiBf61YmuLGUk+uCiDl4rW+t4PDjGZTHTfRQY/Y3tI+HifADsTwhMfdlAqZykdKH4e8ezO5xo uHNwKv7Wx4gERwzrnKonE+bgwg1E/RZltRs7G+ZLvGbb/gppvRGNNsTHjWq7VlTuXtNfpzb64YMi IovfFwq4JGVtgGlxgMkn8cHz1fseTbU8eaqY9GjRyKTBJC4/4XL/V3X3TNdnteL0FLpPPwmFv+4s 2a6rNbHZTn9HAdXQfqz6pGGMoSiNmmda2QtttfRLmxpZiOCapYgg7LGznlm7SkpV7ytwp7DGRVH+ gPkNPEsFfSMI/3TGg2aYup3j8N6djd5e16r3UwwYzaeiM2DR4MT/nc/TKtabvakVkTUQANO5hJCs vLujzPQPeTt4cO8Iydch+/naGqTGJnCjpDYKz6rI7ooLDxqB72CxBO4/1IVLPKVzpXScT8FV9Q0X bPyC+7x8p24n/Rk/YbDoYegX3mOjAQioY1NrUp/6QP6ErQGGDGdlQW3LxjTM6OO5OEqsPe5mTGYn hrjdet1cPoxONv4QEbnb+uV2ap2JXd3yzHKyzPeLEEZ50mByn8RBF5vW7wLwXHK+US6vKVtvchMN ptSAJNdIkJi8Jtia3DF/w4rTn74Jn2K261AjRgjA3FM+LjzYzWzi2u/faqKzmu8iKBbCesbN7JDR pyBEfTXQGtF3lSp1Qsx3RBnWkZtpjkuRTjPLTygGNeSWil44spO+duSLCGvbztTg4RoHo4Z2SPfE i3HTfx9rLQ9eyAACPvto43OwsF/YVmKwZeyrG4L1J9MpdC+tbxUdpFag+yzZOo2r4Z1SJEWWq+w4 mJ86xJuXPz+pYE/ON7dmipLCgXVjkJ/plVe5z5gn7UnuMG5MUm8CVkU/Hk77Lh1qrSTM0I3n20fq dPVjYOGsm0r8kVRfBnlyUAJOFMF/ijA1xuVwtn2UfSNhZHzU5xcA== X-QQ-XMRINFO: NS+P29fieYNwqS3WCnRCOn9D1NpZuCnCRA== From: Edward Adam Davis To: syzbot+33e571025d88efd1312c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write Date: Fri, 10 Apr 2026 08:56:28 +0800 X-OQ-MSGID: <20260410005627.117156-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69d779b0.a00a0220.468cb.0018.GAE@google.com> References: <69d779b0.a00a0220.468cb.0018.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4ca3cb993da2..c0cfe91c2991 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4005,11 +4005,11 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, return -ENODEV; cgroup_get(cgrp); - cgroup_kn_unlock(of->kn); /* Allow only one trigger per file descriptor */ if (ctx->psi.trigger) { cgroup_put(cgrp); + cgroup_kn_unlock(of->kn); return -EBUSY; } @@ -4017,12 +4017,14 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, new = psi_trigger_create(psi, buf, res, of->file, of); if (IS_ERR(new)) { cgroup_put(cgrp); + cgroup_kn_unlock(of->kn); return PTR_ERR(new); } smp_store_release(&ctx->psi.trigger, new); cgroup_put(cgrp); + cgroup_kn_unlock(of->kn); return nbytes; }