css_rstat_exit() may be called asynchronously in scenarios where preceding
calls to css_rstat_init() have not completed. One such example is this
sequence below:

css_create(...)
{
	...
	init_and_link_css(css, ...);

	err = percpu_ref_init(...);
	if (err)
		goto err_free_css;
	err = cgroup_idr_alloc(...);
	if (err)
		goto err_free_css;
	err = css_rstat_init(css, ...);
	if (err)
		goto err_free_css;
	...
err_free_css:
	INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
	queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
	return ERR_PTR(err);
}

If any of the three goto jumps are taken, async cleanup will begin and
css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.

Avoid accessing the unitialized field by returning early in
css_rstat_exit() if this is the case.

Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
Suggested-by: Michal Koutný <mkoutny@suse.com>
Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
---
 kernel/cgroup/rstat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index cbeaa499a96a..408e52d5f7a4 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys_state *css)
 	if (!css_uses_rstat(css))
 		return;
 
+	if (!css->rstat_cpu)
+		return;
+
 	css_rstat_flush(css);
 
 	/* sanity check */
-- 
2.47.3

On Wed, Aug 06, 2025 at 05:33:50PM -0700, JP Kobryn wrote:
> css_rstat_exit() may be called asynchronously in scenarios where preceding
> calls to css_rstat_init() have not completed. One such example is this
> sequence below:
> 
> css_create(...)
> {
> 	...
> 	init_and_link_css(css, ...);
> 
> 	err = percpu_ref_init(...);
> 	if (err)
> 		goto err_free_css;
> 	err = cgroup_idr_alloc(...);
> 	if (err)
> 		goto err_free_css;
> 	err = css_rstat_init(css, ...);
> 	if (err)
> 		goto err_free_css;
> 	...
> err_free_css:
> 	INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
> 	queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
> 	return ERR_PTR(err);
> }
> 
> If any of the three goto jumps are taken, async cleanup will begin and
> css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
> 
> Avoid accessing the unitialized field by returning early in
> css_rstat_exit() if this is the case.
> 
> Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
> Suggested-by: Michal Koutný <mkoutny@suse.com>
> Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
> Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com
> Acked-by: Shakeel Butt <shakeel.butt@linux.dev>

Applied to cgroup/for-6.17-fixes.

Thanks.

-- 
tejun