Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write

[Hillf Danton <hdanton@sina.com>]

> Date: Thu, 09 Apr 2026 03:04:32 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    591cd656a1bf Linux 7.0-rc7
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=114a36ba580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=45cb3c58fd963c27
> dashboard link: https://syzkaller.appspot.com/bug?extid=33e571025d88efd1312c
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16cb33da580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12648bd6580000

#syz test

--- x/fs/kernfs/file.c
+++ y/fs/kernfs/file.c
@@ -756,6 +756,7 @@ static void kernfs_release_file(struct k
 	lockdep_assert_held(kernfs_open_file_mutex_ptr(kn));
 
 	if (!of->released) {
+		mutex_lock(&of->mutex);
 		/*
 		 * A file is never detached without being released and we
 		 * need to be able to release files which are deactivated
@@ -764,6 +765,7 @@ static void kernfs_release_file(struct k
 		kn->attr.ops->release(of);
 		of->released = true;
 		of_on(of)->nr_to_release--;
+		mutex_unlock(&of->mutex);
 	}
 }
 
--