Re: [syzbot] [cgroups?] KASAN: slab-use-after-free Read in pressure_write

[Hillf Danton <hdanton@sina.com>]

> Date: Thu, 09 Apr 2026 03:04:32 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    591cd656a1bf Linux 7.0-rc7
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=114a36ba580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=45cb3c58fd963c27
> dashboard link: https://syzkaller.appspot.com/bug?extid=33e571025d88efd1312c
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16cb33da580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12648bd6580000

#syz test

--- x/kernel/cgroup/cgroup.c
+++ y/kernel/cgroup/cgroup.c
@@ -3995,7 +3995,7 @@ static int cgroup_cpu_pressure_show(stru
 static ssize_t pressure_write(struct kernfs_open_file *of, char *buf,
 			      size_t nbytes, enum psi_res res)
 {
-	struct cgroup_file_ctx *ctx = of->priv;
+	struct cgroup_file_ctx *ctx;
 	struct psi_trigger *new;
 	struct cgroup *cgrp;
 	struct psi_group *psi;
@@ -4004,14 +4004,18 @@ static ssize_t pressure_write(struct ker
 	if (!cgrp)
 		return -ENODEV;
 
-	cgroup_get(cgrp);
-	cgroup_kn_unlock(of->kn);
-
+	ctx = of->priv;
+	if (!ctx) {
+		cgroup_kn_unlock(of->kn);
+		return -ENODEV;
+	}
 	/* Allow only one trigger per file descriptor */
 	if (ctx->psi.trigger) {
-		cgroup_put(cgrp);
+		cgroup_kn_unlock(of->kn);
 		return -EBUSY;
 	}
+	cgroup_get(cgrp);
+	cgroup_kn_unlock(of->kn);
 
 	psi = cgroup_psi(cgrp);
 	new = psi_trigger_create(psi, buf, res, of->file, of);
@@ -4019,9 +4023,27 @@ static ssize_t pressure_write(struct ker
 		cgroup_put(cgrp);
 		return PTR_ERR(new);
 	}
+	cgroup_put(cgrp);
 
+	cgrp = cgroup_kn_lock_live(of->kn, false);
+	if (!cgrp) {
+		psi_trigger_destroy(new);
+		return -ENODEV;
+	}
+	ctx = of->priv;
+	if (!ctx) {
+		cgroup_kn_unlock(of->kn);
+		psi_trigger_destroy(new);
+		return -ENODEV;
+	}
+	/* Allow only one trigger per file descriptor */
+	if (ctx->psi.trigger) {
+		cgroup_kn_unlock(of->kn);
+		psi_trigger_destroy(new);
+		return -EBUSY;
+	}
 	smp_store_release(&ctx->psi.trigger, new);
-	cgroup_put(cgrp);
+	cgroup_kn_unlock(of->kn);
 
 	return nbytes;
 }
--