Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Tejun Heo <htejun@gmail.com>
Date:   Thu, 12 Jan 2023 15:14:30 -1000
From:   "tj@kernel.org" <tj@kernel.org>
To:     Lixiong Liu =?utf-8?B?KOWImOWIqembhCk=?= 
        <Lixiong.Liu@mediatek.com>
Cc:     "lizefan@huawei.com" <lizefan@huawei.com>,
        "hannes@cmpxchg.org" <hannes@cmpxchg.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-mediatek@lists.infradead.org" 
        <linux-mediatek@lists.infradead.org>,
        "cgroups@vger.kernel.org" <cgroups@vger.kernel.org>,
        Wenju Xu =?utf-8?B?KOiuuOaWh+S4vik=?= <Wenju.Xu@mediatek.com>,
        wsd_upstream <wsd_upstream@mediatek.com>,
        Jing-Ting Wu =?utf-8?B?KOWQs+mdnOWptyk=?= 
        <Jing-Ting.Wu@mediatek.com>,
        WJ Wang =?utf-8?B?KOeOi+WGmyk=?= <wj.wang@mediatek.com>,
        "linux-arm-kernel@lists.infradead.org" 
        <linux-arm-kernel@lists.infradead.org>,
        Andress Kuo =?utf-8?B?KOmDreWtn+S/rik=?= 
        <Andress.Kuo@mediatek.com>,
        "matthias.bgg@gmail.com" <matthias.bgg@gmail.com>
Subject: Re: cgroup user-after-free
Message-ID: <Y8Cwdsk5pYNd8fX8@slm.duckdns.org>
References: <697032f2331a92eec0e03e85e46cb78bd975a788.camel@mediatek.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <697032f2331a92eec0e03e85e46cb78bd975a788.camel@mediatek.com>
Precedence: bulk

On Thu, Jan 12, 2023 at 09:48:55AM +0000, Lixiong Liu (刘利雄) wrote:
> Hi,
> 
> We meet cgroup use-after-free happened in T SW version with 
> 
> kernel-5.15.
>  
> Root cause: 
> cgroup_migrate_finish free cset’s cgroup,
> 
> but cgroup_sk_alloc use the freed cgroup,
> 
> then use-after-free happened.

Sounds similar to the problem fixed by 07fd5b6cdf3c ("cgroup: Use separate
src/dst nodes when preloading css_sets for migration"). Can you try it out?

Thanks.

-- 
tejun