[PATCH cgroup/for-6.16-fixes] cgroup: avoid null de-ref in css_rstat_exit()

From: JP Kobryn
Date: Thu Jul 31 2025 - 15:29:21 EST


This function may be called asynchronously in scenarios where preceding
calls to css_rstat_init() have not completed. Return early in this case.

Signed-off-by: JP Kobryn <inwardvessel@xxxxxxxxx>
Suggested-by: Michal Koutný <mkoutny@xxxxxxxx>
Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
Reported-by: syzbot+8d052e8b99e40bc625ed@xxxxxxxxxxxxxxxxxxxxxxxxx
---
kernel/cgroup/rstat.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index cbeaa499a96a..408e52d5f7a4 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys_state *css)
if (!css_uses_rstat(css))
return;

+ if (!css->rstat_cpu)
+ return;
+
css_rstat_flush(css);

/* sanity check */
--
2.47.3