[PATCH printk] printk: Fix possible console use-after-free

[PATCH printk] printk: Fix possible console use-after-free

[John Ogness]

When emitting a record via legacy printing, it is possible that a handover
to another legacy printing context occurs. When a context has performed a
handover, the console SRCU read lock is released and the pointer to the
console struct might now be invalid. Therefore, after calling
nbcon_legacy_emit_next_record() or console_emit_next_record(), it is
necessary to check if a handover occurred _before_ further @con usage.

Sashiko pointed out that console_flush_one_record() was not doing this.

In console_flush_one_record(), after emitting a record, move the further
usage of @con after the handover check.

Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@smtp.kernel.org
Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 kernel/printk/printk.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 2fe9a963c823a..6d363e42e2a05 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -3264,10 +3264,8 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *
 		if (flags & CON_NBCON) {
 			progress = nbcon_legacy_emit_next_record(con, handover, cookie,
 								 !do_cond_resched);
-			printk_seq = nbcon_seq_read(con);
 		} else {
 			progress = console_emit_next_record(con, handover, cookie);
-			printk_seq = con->seq;
 		}
 
 		/*
@@ -3277,6 +3275,15 @@ static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *
 		if (*handover)
 			goto fail;
 
+		/*
+		 * @con can be used here now that it is certain that this
+		 * context is still holding the SRCU read lock.
+		 */
+		if (flags & CON_NBCON)
+			printk_seq = nbcon_seq_read(con);
+		else
+			printk_seq = con->seq;
+
 		/* Track the next of the highest seq flushed. */
 		if (printk_seq > *next_seq)
 			*next_seq = printk_seq;

base-commit: 080d60fffa8e0d285871cde8395438006a9b5b0c
-- 
2.47.3

Re: [PATCH printk] printk: Fix possible console use-after-free

[Petr Mladek]

On Fri 2026-07-03 16:20:31, John Ogness wrote:
> When emitting a record via legacy printing, it is possible that a handover
> to another legacy printing context occurs. When a context has performed a
> handover, the console SRCU read lock is released and the pointer to the
> console struct might now be invalid. Therefore, after calling
> nbcon_legacy_emit_next_record() or console_emit_next_record(), it is
> necessary to check if a handover occurred _before_ further @con usage.
> 
> Sashiko pointed out that console_flush_one_record() was not doing this.
> 
> In console_flush_one_record(), after emitting a record, move the further
> usage of @con after the handover check.
> 
> Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@smtp.kernel.org
> Signed-off-by: John Ogness <john.ogness@linutronix.de>

Great catch!

The fix it straightfoward:

Reviewed-by: Petr Mladek <pmladek@suse.com>

Now, the question is whether I should rush it into 7.2-rcX or
it might wait for 7.3.

IMHO, it can wait for 7.3 because it is very hard to trigger.
All console drivers have "struct console" defined in the static .data
section. It can disappear only when it is added as a module and
the module gets removed. Which is a rather complicated and long
process.

Best Regards,
Petr

Re: [PATCH printk] printk: Fix possible console use-after-free

[John Ogness]

On 2026-07-07, Petr Mladek <pmladek@suse.com> wrote:
> Now, the question is whether I should rush it into 7.2-rcX or
> it might wait for 7.3.
>
> IMHO, it can wait for 7.3 because it is very hard to trigger.
> All console drivers have "struct console" defined in the static .data
> section. It can disappear only when it is added as a module and
> the module gets removed. Which is a rather complicated and long
> process.

I am fine with it waiting until 7.3.

John

Re: [PATCH printk] printk: Fix possible console use-after-free

[Petr Mladek]

On Fri 2026-07-03 16:20:31, John Ogness wrote:
> When emitting a record via legacy printing, it is possible that a handover
> to another legacy printing context occurs. When a context has performed a
> handover, the console SRCU read lock is released and the pointer to the
> console struct might now be invalid. Therefore, after calling
> nbcon_legacy_emit_next_record() or console_emit_next_record(), it is
> necessary to check if a handover occurred _before_ further @con usage.
> 
> Sashiko pointed out that console_flush_one_record() was not doing this.
> 
> In console_flush_one_record(), after emitting a record, move the further
> usage of @con after the handover check.
> 
> Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@smtp.kernel.org
> Signed-off-by: John Ogness <john.ogness@linutronix.de>

JFYI, the patch has been committed into printk/linux.git,
branch for-7.3-trivial.

Best Regards,
Petr