[Devel] [PATCH hci-8.1 3/6] ms/cgroup/dmem: avoid pool UAF

[no-reply at sashiko.virtuozzo.com]

> From: Chen Ridong <chenridong at huawei.com>
> 
> An UAF issue was observed:
> 
> BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150
> Write of size 8 at addr ffff888106715440 by task insmod/527
> 
> CPU: 4 UID: 0 PID: 527 Comm: insmod    6.19.0-rc7-next-20260129+ #11
> Tainted: [O]=OOT_MODULE
> Call Trace:
> <TASK>
> dump_stack_lvl+0x82/0xd0
> kasan_report+0xca/0x100
> kasan_check_range+0x39/0x1c0
> page_counter_uncharge+0x65/0x150
> [ ... ]
> does not include linux/rculist.h and the new linux/refcount.h include
> goes after linux/parser.h. The change is otherwise the same.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-152813
> Signed-off-by: Mirian Shilakadze <mirian.shilakadze at virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261101235155.124059-1-mirian.shilakadze@virtuozzo.com?part=3