Re: [PATCH v2] cgroup: Do not corrupt task iteration when rebinding subsystem

[Tejun Heo]

On Sat, Jun 10, 2023 at 05:26:43PM +0800, Xiu Jianfeng wrote:
> From: Xiu Jianfeng <xiujianfeng@xxxxxxxxxx>
> 
> We found a refcount UAF bug as follows:
...
> To fix this issue, switch from all css_sets to only scgrp's css_sets to
> patch in-flight iterators to preserve correct iteration, and then
> update it->cset_head as well.
> 
> Reported-by: Gaosheng Cui <cuigaosheng1@xxxxxxxxxx>
> Link: https://www.spinics.net/lists/cgroups/msg37935.html
> Suggested-by: Michal Koutný <mkoutny@xxxxxxxx>
> Link: https://lore.kernel.org/all/20230526114139.70274-1-xiujianfeng@xxxxxxxxxxxxxxx/
> Signed-off-by: Xiu Jianfeng <xiujianfeng@xxxxxxxxxx>

Applied to cgroup/for-6.14-fixes w/ stable tag added.

Thanks.

-- 
tejun