cgroup/psi: Set of->priv to NULL upon file release

CKI Backport Bot · CKI Backport Bot · commit 2a5fc56cdb5c · 2025-10-16T18:04:40.000Z
JIRA: https://issues.redhat.com/browse/RHEL-119145 CVE: CVE-2025-39881 commit 94a4acf Author: Chen Ridong <chenridong@huawei.com> Date: Fri Aug 22 07:07:15 2025 +0000 cgroup/psi: Set of->priv to NULL upon file release Setting of->priv to NULL when the file is released enables earlier bug detection. This allows potential bugs to manifest as NULL pointer dereferences rather than use-after-free errors[1], which are generally more difficult to diagnose. [1] https://lore.kernel.org/cgroups/38ef3ff9-b380-44f0-9315-8b3714b0948d@huaweicloud.com/T/#m8a3b3f88f0ff3da5925d342e90043394f8b2091b Signed-off-by: Chen Ridong <chenridong@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
@@ -4109,6 +4109,7 @@ static void cgroup_file_release(struct kernfs_open_file *of)
 		cft->release(of);
 	put_cgroup_ns(ctx->ns);
 	kfree(ctx);
+	of->priv = NULL;
 }
 
 static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf,

Original file line number	Diff line number	Diff line change
`@@ -4109,6 +4109,7 @@ static void cgroup_file_release(struct kernfs_open_file *of)`
`4109`	`4109`	`cft->release(of);`
`4110`	`4110`	`put_cgroup_ns(ctx->ns);`
`4111`	`4111`	`kfree(ctx);`
	`4112`	`+ of->priv = NULL;`
`4112`	`4113`	`}`
`4113`	`4114`
`4114`	`4115`	`static ssize_t cgroup_file_write(struct kernfs_open_file of, char buf,`