Re:Re: [PATCH] Re:[PATCH v3] zram: fix use-after-free in zram_writeback_endio

["wang wei" <a929244872@163.com>]

[-- Attachment #1: Type: text/plain, Size: 1178 bytes --]

At 2026-05-15 06:02:37, "Minchan Kim" <minchan@kernel.org> wrote:
>On Wed, May 13, 2026 at 10:02:18PM +0800, wang wei wrote:
>> >@@ -847,7 +849,7 @@ static void release_wb_ctl(struct zram_wb_ctl *wb_ctl)
>> > 		release_wb_req(req);
>> > 	}
>> >
>> >-	kfree(wb_ctl);
>> >+	kfree_rcu(wb_ctl, rcu);
>> > }
>> 
>> Do we need to add a 'rcu_assign_pointer(wb_ctl, NULL);' before 'kfree_rcu(wb_ctl, rcu)'?
>> 
>> Signed-off-by: wang wei <a929244872@163.com>
>
>Why do we need it?
>
>My understanding is rcu_assign_pointer() is typically used to publish NULL to
>a shared pointer variable so that future RCU readers (using rcu_dereference)
>won't access the object before kfree_rcu().

That's exactly what I'm worried is that some process might access wb_ctl before kfree_rct().


>However, in our case, wb_ctl is not stored in any shared pointer variable.
>It is a local variable in writeback_store() and RCU readers (zram_writeback_endio)
>do not look up wb_ctl from a shared pointer. They obtain it directly from
>bio->bi_private of the specific bio they are completing.

Thank you for the lessones; I realize my worries were unnecessary.


>Please let me know if I missed anything.

[-- Attachment #2: Type: text/html, Size: 1538 bytes --]