From: Thomas Gleixner <tglx@kernel.org>
To: Zhan Xusheng <zhanxusheng1024@gmail.com>
Cc: linux-kernel@vger.kernel.org, Zhan Xusheng <zhanxusheng@xiaomi.com>
Subject: Re: [PATCH] alarmtimer: Fix use-after-free of timerqueue node in alarmtimer_suspend()
Date: Tue, 07 Apr 2026 15:57:49 +0200 [thread overview]
Message-ID: <877bqi6ffm.ffs@tglx> (raw)
In-Reply-To: <20260330061559.8997-1-zhanxusheng@xiaomi.com>
On Mon, Mar 30 2026 at 14:15, Zhan Xusheng wrote:
> In alarmtimer_suspend(), the timerqueue_node pointer 'next' is obtained
> under base->lock via scoped_guard(), but its members (next->expires)
> are accessed after the lock has been released when the scoped_guard
> goes out of scope.
>
> Between the lock release and the dereference, a concurrent timer
> cancellation on another CPU could remove and free the timerqueue node,
> leading to a use-after-free.
That's correct in theory, but it's a made up scenario as this runs
during suspend after all processes which could remove and free it have
been frozen already.
That said, I have no objections against the patch per se, but I'm not
accepting the unrealistic argument backing it up.
Using AI is fine, but taking the output at face value is not.
Thanks,
tglx
prev parent reply other threads:[~2026-04-07 13:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-30 6:15 [PATCH] alarmtimer: Fix use-after-free of timerqueue node in alarmtimer_suspend() Zhan Xusheng
2026-04-07 13:57 ` Thomas Gleixner [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877bqi6ffm.ffs@tglx \
--to=tglx@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=zhanxusheng1024@gmail.com \
--cc=zhanxusheng@xiaomi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox