6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Kobryn inwardvessel@gmail.com
commit eea51c6e3f6675b795f6439eaa960eb2948d6905 upstream.
css_rstat_exit() may be called asynchronously in scenarios where preceding calls to css_rstat_init() have not completed. One such example is this sequence below:
css_create(...) { ... init_and_link_css(css, ...);
err = percpu_ref_init(...); if (err) goto err_free_css; err = cgroup_idr_alloc(...); if (err) goto err_free_css; err = css_rstat_init(css, ...); if (err) goto err_free_css; ... err_free_css: INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn); queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork); return ERR_PTR(err); }
If any of the three goto jumps are taken, async cleanup will begin and css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
Avoid accessing the unitialized field by returning early in css_rstat_exit() if this is the case.
Signed-off-by: JP Kobryn inwardvessel@gmail.com Suggested-by: Michal Koutný mkoutny@suse.com Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem") Cc: stable@vger.kernel.org # v6.16 Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com Acked-by: Shakeel Butt shakeel.butt@linux.dev Signed-off-by: Tejun Heo tj@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/cgroup/rstat.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/kernel/cgroup/rstat.c +++ b/kernel/cgroup/rstat.c @@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys if (!css_uses_rstat(css)) return;
+ if (!css->rstat_cpu) + return; + css_rstat_flush(css);
/* sanity check */