CVE-2026-93100: fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

In the Linux kernel, the following vulnerability has been resolved:

fs/resctrl: Prevent use-after-free in rdtgroupknput()

A struct rdtgroup is reference counted via rdtgroup::waitcount. Callers that need the structure to remain valid across a sleep (while waiting on acquiring rdtgroupmutex) take a reference with rdtgroupknget() and release it with rdtgroupknput().

The release path is intended to serve as the fallback freer: if the count drops to zero and the group has already been marked RDTDELETED, rdtgroupknput() frees the structure.

The bulk teardown paths freeallchildrdtgrp() and rmdirallsub() resulting from a resctrl directory remove or resctrl fs unmount act as the primary freer: they hold rdtgroupmutex and free each rdtgroup whose waitcount is zero, otherwise they set RDTDELETED and leave the freeing to the last waiter.

These two freers race. rdtgroupknput() commits waitcount == 0 with atomicdecandtest() outside rdtgroupmutex, then reads rdtgroup::flags. Between those two operations a concurrent caller of freeallchildrdtgrp() or rmdirallsub() (which holds the mutex) can observe waitcount == 0 via atomicread(), call rdtgroupremove(), and kfree() the structure.

The subsequent read of rdtgroup::flags in rdtgroupknput() is then a use-after-free, and the structure may even be freed twice if the freed memory happens to satisfy the RDTDELETED flag check.

Replace the bare atomicdecandtest() with atomicdecandmutexlock() so that the decrement-to-zero takes rdtgroupmutex before the count becomes globally visible. The inspection of rdtgroup::flags then runs under the same mutex held by the bulk freers, making the two paths mutually exclusive.

The common case where the count does not reach zero remains lock-free. Defer kernfsunbreakactiveprotection() until after the mutex is dropped since kernfs active protections functionally wrap rdtgroupmutex. Remove resource group, which in turn drops its kernfs reference, after kernfs protection is restored.

[ bp: Split the commit messsages into smaller, easier-parseable paragraphs. ]