Re: [PATCH 6.12.y] cgroup: Fix kernfs_node UAF in css_free_rwork_fn

[Michal Koutný]

On Thu, Jan 29, 2026 at 11:11:48AM -0800, "T.J. Mercier" <tjmercier@xxxxxxxxxx> wrote:
> On Thu, Jan 29, 2026 at 11:10 AM T.J. Mercier <tjmercier@xxxxxxxxxx> wrote:
> >
> > This fix patch is not upstream, and is applicable only to kernels 6.10
> > (where the cgroup_rstat_lock tracepoint was added) through 6.15 after
> > which commit 5da3bfa029d6 ("cgroup: use separate rstat trees for each
> > subsystem") reordered cgroup_rstat_flush as part of a new feature
> > addition and inadvertently fixed this UAF.
> 
> I am proposing we apply this one-off patch to stable rather than
> backporting 5da3bfa029d6 ("cgroup: use separate rstat trees for each
> subsystem") and its fixes to 6.12.y.

That's a performance optimization rework, IMO too big for stable.

For the conservative stable-specific fixup:

Acked-by: Michal Koutný <mkoutny@xxxxxxxx>

Thanks!

Attachment: signature.asc
Description: PGP signature