From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
chenridong@huawei.com, tj@kernel.org, lulie@linux.alibaba.com,
lizefan.x@bytedance.com, hannes@cmpxchg.org,
cgroups@vger.kernel.org, linux-kernel@vger.kernel.org,
eadavis@qq.com, chenridong@huaweicloud.com,
akpm@linux-foundation.org, surenb@google.com,
dust.li@linux.alibaba.com
Subject: Re: [PATCH 6.12.y 0/2] sched/psi: fix race in pressure_write (CVE-2026-52991)
Date: Thu, 16 Jul 2026 21:37:36 -0400 [thread overview]
Message-ID: <20260716232340.0009-stable-reply@kernel.org> (raw)
In-Reply-To: <20260715083245.32115-1-lulie@linux.alibaba.com>
On Wed, Jul 15, 2026 at 04:32:43PM +0800, Philo Lu wrote:
> Backport of the CVE-2026-52991 fix.
>
> 1/2 (94a4acfec146) clear of->priv on release, turning the UAF into an
> easier-to-detect NULL deref.
> 2/2 (a5b98009f16d, the CVE fix) extend cgroup_mutex to cover all
> of->priv accesses, read ctx after taking the kn lock, and NULL-check
> of->priv. It depends on 1/2 as discussed in [0].
I'm holding off on this series (and the 6.6.y/6.1.y ones) for now: a5b98009f16d
moves the psi trigger write path under cgroup_mutex, which means the psimon
kthread gets created while holding cgroup_mutex and introduces a deadlock risk.
Tejun has a follow-up fix for that which is in the cgroup tree but hasn't
reached mainline yet. Once it lands, I'll queue your series together with it on
all three branches.
--
Thanks,
Sasha
next prev parent reply other threads:[~2026-07-17 1:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-15 8:32 [PATCH 6.12.y 0/2] sched/psi: fix race in pressure_write (CVE-2026-52991) Philo Lu
2026-07-15 8:32 ` [PATCH 6.12.y 1/2] cgroup/psi: Set of->priv to NULL upon file release Philo Lu
2026-07-15 8:32 ` [PATCH 6.12.y 2/2] sched/psi: fix race between file release and pressure write Philo Lu
2026-07-17 1:37 ` Sasha Levin [this message]
2026-07-17 2:12 ` [PATCH 6.12.y 0/2] sched/psi: fix race in pressure_write (CVE-2026-52991) Philo Lu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260716232340.0009-stable-reply@kernel.org \
--to=sashal@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=cgroups@vger.kernel.org \
--cc=chenridong@huawei.com \
--cc=chenridong@huaweicloud.com \
--cc=dust.li@linux.alibaba.com \
--cc=eadavis@qq.com \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan.x@bytedance.com \
--cc=lulie@linux.alibaba.com \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox