[PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in css_rstat_exit()

JP Kobryn posted 1 patch 2 months ago
There is a newer version of this series
kernel/cgroup/rstat.c | 3 +++
1 file changed, 3 insertions(+)
[PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in css_rstat_exit()
Posted by JP Kobryn 2 months ago
This function may be called asynchronously in scenarios where preceding
calls to css_rstat_init() have not completed. Return early in this case.

Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
Suggested-by: Michal Koutný <mkoutny@suse.com>
Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com
---
 kernel/cgroup/rstat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index cbeaa499a96a..408e52d5f7a4 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys_state *css)
 	if (!css_uses_rstat(css))
 		return;
 
+	if (!css->rstat_cpu)
+		return;
+
 	css_rstat_flush(css);
 
 	/* sanity check */
-- 
2.47.3

Re: [PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in css_rstat_exit()
Posted by Shakeel Butt 2 months ago
On Thu, Jul 31, 2025 at 12:27:34PM -0700, JP Kobryn wrote:
> This function

Name the function i.e. css_rstat_exit()

> may be called asynchronously in scenarios where preceding
> calls to css_rstat_init() have not completed.

Explain some (or just one) of these scenarios in the commit.

> Return early in this case.
> 
> Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
> Suggested-by: Michal Koutný <mkoutny@suse.com>
> Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
> Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com

With the updated commit message, please include:

Acked-by: Shakeel Butt <shakeel.butt@linux.dev>