Re: [PATCH] cgroup/rstat: validate cpu before css_rstat_cpu() access

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `css_rstat_updated` kfunc is vulnerable to a kernel panic if a BPF tracing program passes a `css` pointer where `css->rstat_cpu` is uninitialized (NULL).
--

commit e8d546639085dcc3eee578c0dace07ba513cb482
Author: Qing Ming <a0yami@mailbox.org>

cgroup/rstat: validate cpu before css_rstat_cpu() access

This commit adds a bounds and validity check for the cpu parameter in
css_rstat_updated() to prevent an out-of-bounds array access when called
from a BPF program.

> diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
> --- a/kernel/cgroup/rstat.c
> +++ b/kernel/cgroup/rstat.c
[ ... ]
> @@ -90,6 +91,9 @@ __bpf_kfunc void css_rstat_updated(struct cgroup_subsys_state *css, int cpu)
>  	     !IS_ENABLED(CONFIG_ARCH_HAS_NMI_SAFE_THIS_CPU_OPS)) && in_nmi())
>  		return;
>  
> +	if (unlikely(cpu < 0 || cpu >= nr_cpu_ids || !cpu_possible(cpu)))
> +		return;
> +
>  	rstatc = css_rstat_cpu(css, cpu);

Could this still lead to a panic if css->rstat_cpu is uninitialized?

The existing check at the top of this function:

    if (!css_uses_rstat(css))
        return;

only verifies that css->ss->css_rstat_flush is defined. It doesn't appear
to check if the per-cpu memory css->rstat_cpu has actually been allocated.

If a BPF program intercepts a css object during allocation (for example, by
tracing init_and_link_css before css_rstat_init completes), or if an
untrusted pointer is passed because the kfunc lacks KF_TRUSTED_ARGS,
css->rstat_cpu could be NULL.

In that scenario, css_rstat_cpu() would compute per_cpu_ptr(NULL, cpu),
which returns an offset from NULL rather than a valid memory address. The
subsequent call to llist_on_list() would then dereference this invalid
address.

Should there be an explicit check for !css->rstat_cpu to safely handle
uninitialized rstat state from BPF callers?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260515122952.59209-1-a0yami@mailbox.org?part=1