Re: [RFC][PATCH] make sure that lock_for_kill() callers drop the locks in safe order

Al Viro
2026-04-10T19:15:21Z

On Fri, Apr 10, 2026 at 02:21:39PM -0400, Jeff Layton wrote:

> I've not been able to reproduce the UAF at all.
>
> It was possible to reproduce the hang that we were seeing by injecting
> an mdelay() just after the cond_resched() in __dentry_kill(), but Al's
> other series seems to have fixed that.

Elimination of busy-wait is likely to hide whatever's going on, so it
shouldn't be there when hunting for reproducer.

> The UAF seems to be dependent on those hangs somehow, but we were never
> able to get one to fire from a reproducer attempt. They just
> occasionally pop up when these stalls occur.

Not even with mdelay() stuck in there? FWIW, another UAF report in the
same general area is parisc buildd running into that when building
a specific package (webkit2gtk); Debian kernels 6.16..6.19 (at least),
no idea which config it is...