Re: [PATCH v3 3/9] fs/resctrl: Fix use-after-free during unmount

[Chen Yu]

On Fri, 22 May 2026 12:15:07 -0700, Reinette Chatre wrote:
> When the mutex is released, the reader wakes up, observes that RDT_DELETED
> is not set for the default group, and dereferences the already-freed
> file private data.

I wonder if a code call sequence could be added in the commit log,
which would be helpful to quickly understand the race condition:

CPU 0 (read mon_data file)          CPU 1 (umount)
--------------------------          --------------

rdtgroup_kn_lock_live()
  rdtgrp = &rdtgroup_default
  waitcount++
  break_active_protection()
                                    mutex_lock()
                                    mon_put_kn_priv()
                                      kfree(mon_data)
                                    mutex_unlock()
  mutex_lock()
  rdtgrp->flags & RDT_DELETED?
    // no -- never set for default
  return rdtgrp

md = of->kn->priv  // UAF: freed


I did not find issues in current implementation,

Reviewed-by: Chen Yu <yu.c.chen@xxxxxxxxx>