Re: [PATCH printk v2] printk: Avoid multiple unregistration in unregister_console_locked()

[Petr Mladek <pmladek@suse.com>]

On Fri 2026-10-30 15:03:55, John Ogness wrote:
> unregister_console_locked() is called from within
> hlist_for_each_entry_safe(console_list) loops. This would be safe if
> unregister_console_locked() only unregistered the specified console. After
> all, that is what the _safe variant is for.
> 
> However, unregister_console_locked() calls printk_kthreads_check_locked(),
> which can unregister _multiple_ consoles if kthreads fail to start. This
> could lead to hlist_for_each_entry_safe() use-after-free scenarios because
> not only was the list entry removed, but possibly the following entry as
> well (the @n temporary storage of the next entry).
> 
> Move the call to printk_kthreads_check_locked() outside of
> unregister_console_locked(). Add comments to both functions to clarify
> if they are safe to be used in hlist_for_each_entry_safe(console_list)
> loops.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/lkml/87ik31iz4x.fsf@jogness.linutronix.de
> Fixes: 76f258bf3f2a ("printk: nbcon: Introduce printer kthreads")
> Signed-off-by: John Ogness <john.ogness@linutronix.de>

Looks good to me:

Reviewed-by: Petr Mladek <pmladek@suse.com>

Now, I am not sure whether to queue this for 7.4-rc2 or 7.5.
One one hand, it is a potential use-after free. On the other hand,
it is rather a corner case which is hard to hit. And it would likely
happen during boot where it is not that dangerous.

Well, I am rather confident with the fix now. So I personally
prefer 7.4-rc2 to be on the safe side sooner. And there are
already two more changes in the queue for 7.4-rc2 anyway.

Best Regards,
Petr