On Sat, Jun 10, 2023 at 05:26:43PM +0800, Xiu Jianfeng wrote: > From: Xiu Jianfeng <xiujianfeng@xxxxxxxxxx> > > We found a refcount UAF bug as follows: ... > To fix this issue, switch from all css_sets to only scgrp's css_sets to > patch in-flight iterators to preserve correct iteration, and then > update it->cset_head as well. > > Reported-by: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx> > Link: https://www.spinics.net/lists/cgroups/msg37935.html > Suggested-by: Michal Koutný <mkoutny@xxxxxxxx> > Link: https://lore.kernel.org/all/20230526114139.70274-1-xiujianfeng@xxxxxxxxxxxxxxx/ > Signed-off-by: Xiu Jianfeng <xiujianfeng@xxxxxxxxxx> Applied to cgroup/for-6.14-fixes w/ stable tag added. Thanks. -- tejun
