Re: [PATCH 6.12.y] cgroup: Fix kernfs_node UAF in css_free_rwork_fn

[T.J. Mercier]

On Thu, Jan 29, 2026 at 11:10 AM T.J. Mercier <tjmercier@xxxxxxxxxx> wrote:
>
> This fix patch is not upstream, and is applicable only to kernels 6.10
> (where the cgroup_rstat_lock tracepoint was added) through 6.15 after
> which commit 5da3bfa029d6 ("cgroup: use separate rstat trees for each
> subsystem") reordered cgroup_rstat_flush as part of a new feature
> addition and inadvertently fixed this UAF.

I am proposing we apply this one-off patch to stable rather than
backporting 5da3bfa029d6 ("cgroup: use separate rstat trees for each
subsystem") and its fixes to 6.12.y.

Cgroups folks, please let me know your thoughts.

>  kernel/cgroup/cgroup.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
> index b8cde3d1cb7b..cb756ee15b6f 100644
> --- a/kernel/cgroup/cgroup.c
> +++ b/kernel/cgroup/cgroup.c
> @@ -5481,9 +5481,9 @@ static void css_free_rwork_fn(struct work_struct *work)
>                          * children.
>                          */
>                         cgroup_put(cgroup_parent(cgrp));
> -                       kernfs_put(cgrp->kn);
>                         psi_cgroup_free(cgrp);
>                         cgroup_rstat_exit(cgrp);
> +                       kernfs_put(cgrp->kn);
>                         kfree(cgrp);
>                 } else {
>                         /*
>
> base-commit: abf529abd660d8ccad46dd8c8f20e93db6134f5f
> --
> 2.53.0.rc1.225.gd81095ad13-goog
>