From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from xmbghk7.mail.qq.com (xmbghk7.mail.qq.com [43.163.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B47EA3815E3 for ; Fri, 10 Apr 2026 10:01:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=43.163.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775815266; cv=none; b=B8mz6gIT8PGsh0HXldqXucg0MDoz5oxVMq4wf/upJ+4/Wmpg7weRvqri419uoRBTg9MqzEbKKMu88EBzS8gJN6o2DkrvahLM+NVzrfD2aBA/P3x+H8B/c/C8dstG59jnN61p4zYWpbqKHaarIBUiBNe8YkQHSAy3hKLJGBHAZJk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775815266; c=relaxed/simple; bh=iqkdW6eQQ6SBgodYidxn22J0zvmILxIqBnCVdeod1S4=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=BiKj6t/OysSY8NOZbDMxfSMB3ZFs7MVHAKV2tPKgs7ihmnYLOEQ2w1N9a/DM+82yOrR7CVUza/eGiIeNekH/5+etPRxnqV88AU/nS6XA0LoO8s11yAyomk2QJLILZ+FTGioUUtxYgvDlsk1LjQ9A4tjmO5TFTEtWazE0laXLeCo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=GjGG8/0y; arc=none smtp.client-ip=43.163.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="GjGG8/0y" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1775815261; bh=rTd/frcfCfyWryGppDB03V77n320X1BBkt0rjJgWmg0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GjGG8/0ypqF76lMo4b5G+/KQ2Nb/Vba3QvR2AB9vdfY/uqvK+fvVOBSIEl+gybXgs 2DoZ3iOUv5b9g+iF3Gu3RyBBRvISS/f99WA7rXu6EfRQUa1gbtxj0thVdcaXG8WpEa e9qAdT0Sss6QXEjxiw3PbHOnZw5+i9KEF3B+/0VI= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszb51-0.qq.com (NewEsmtp) with SMTP id 3A8D4A9; Fri, 10 Apr 2026 18:00:58 +0800 X-QQ-mid: xmsmtpt1775815258tnyvrmrk6 Message-ID: X-QQ-XMAILINFO: OOyEews/EdUgH6gGwmV0mGEjJ83qzJSEeaT+WptxlbaBFr9iZCXTNLso7lzvDA hd2zOfNdykECJ9Nlp26Pn/avQ+RvNEsyjwc6h/UpRpRLQq9oHi/71h+ShzV1CbiOMhQ6JS3c9iyO g72dXN2+3/c62sXJGjxZ1idqOCD5p07+HpBxfcPTJ6om6rnvADYvISn9mYGuvyftWzpH4t3JwDzf jngCCZRQOjfBx2daspii38ENY6BDX6jJfyEGsyY+TFEO8TrL5x09xjKMZ1O71X6AgfDOki6qyPnA juEFJy9NtoF6RSPERSk8ykjI5r2ba4aoVSvVLgfuYRdyoQW46FGKHBHz/Z4P1lKqk2SnouvpqnLa 2irbERo/dAW/da6eFP/kwZDpbDm0503O47Z+RYcRXiN1OxLmsb09CyTcslLyAa4RyYa+ClO5ftqW PIMRQD9lV0nf+zjMzmN3PVtNlYCGZVv+ZAqBgTCaAOOAfCVS4k9K0DxNvAIRy/BMw/wZVfe3tALu G+ojTkkSX/Ws8F1NJvNcLfBnPTL4sPdEGKFCracPsupYArSvJ7tpoPI8dNRv0UcdJdgiKFSjZHR6 cdwGDMIMILqeJY54i2eFThyVP7uOs6toAnFUP7dip63j5CKGyzzMFHVw1dzjFlJQAHnenziLzc7m vN/IDvu5CKgApBFqVIeqWIniAO2ZK9Zu+iJ+1FqWIbmUsdelaWhXN9FFejmq0XtL0ChceZ6rX4ss MWmSTHGOAEAIsZZlBi9VoJ5F77o26cTJK9Aaz4JoTq/k7vHm8+7VLhUF0UWebqv8SIrpn2q6W58X w1JkBTrh1at1J9Li0j3JnLxzIGDHVSj5SQQPH65a5tabX12Jp4StdrTnIXOKSUbEdsuW83NffSJh RBv3HqMVijF3mdNEvluu0a/W6rHUaNlw/gQGaxLFaoy70Te96hOpC3ocVx2Ne6UPWWTb+bicpNN6 BdVfPTZ63YZ+K5KwSlj1X9o7HuoFQFlRP+MXuy4OV5C96AyR4PisdqOtfNuBEQ/fu8Mky6LCg= X-QQ-XMRINFO: MSVp+SPm3vtSI1QTLgDHQqIV1w2oNKDqfg== From: Edward Adam Davis To: syzbot+33e571025d88efd1312c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write Date: Fri, 10 Apr 2026 18:00:59 +0800 X-OQ-MSGID: <20260410100058.141556-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69d779b0.a00a0220.468cb.0018.GAE@google.com> References: <69d779b0.a00a0220.468cb.0018.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4ca3cb993da2..bc8ac49b3bec 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -3995,7 +3995,7 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, size_t nbytes, enum psi_res res) { - struct cgroup_file_ctx *ctx = of->priv; + struct cgroup_file_ctx *ctx; struct psi_trigger *new; struct cgroup *cgrp; struct psi_group *psi; @@ -4004,6 +4004,12 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, if (!cgrp) return -ENODEV; + ctx = of->priv; + if (!ctx) { + cgroup_kn_unlock(of->kn); + return -ENODEV; + } + cgroup_get(cgrp); cgroup_kn_unlock(of->kn);