Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write

[Hillf Danton]

> Date: Thu, 09 Apr 2026 03:04:32 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    591cd656a1bf Linux 7.0-rc7
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=114a36ba580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=45cb3c58fd963c27
> dashboard link: https://syzkaller.appspot.com/bug?extid=33e571025d88efd1312c
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16cb33da580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12648bd6580000

#syz test

--- x/fs/kernfs/file.c
+++ y/fs/kernfs/file.c
@@ -775,9 +775,11 @@ static int kernfs_fop_release(struct ino
 	if (kn->flags & KERNFS_HAS_RELEASE) {
 		struct mutex *mutex;
 
+		mutex_lock(&of->mutex);
 		mutex = kernfs_open_file_mutex_lock(kn);
 		kernfs_release_file(kn, of);
 		mutex_unlock(mutex);
+		mutex_unlock(&of->mutex);
 	}
 
 	kernfs_unlink_open_file(kn, of, false);
--