From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 96A97194C96 for ; Tue, 7 Jul 2026 13:05:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783429507; cv=none; b=KQcUHlLdh1OJe0kWa/6lzbHwQ/8/4uP9q4RnTUVTmeiZCZabTrH3Sz+CYXHXV5kuh0sY3Y4q4IKWY2Py+fPelJSU4dmeh1FIdjvAqHowcrTxu8Mrkd2kdwWIAMjT7ZMsMiiLEArNi7OosTqQv1RN/Fjp3QDYm4qOFcTguyXYhbo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783429507; c=relaxed/simple; bh=D+lzaF+pB1ZWzvUVwZOlFwlNlcBiGQRiNzoqxGqbi7k=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=gTh2PjFjsF9NTqPi4EO9glrEito7Kmy4H4e330vgwwyjQVA/K+3Of3bDVoOYhrHZE+7ByF682VW+L2Dagoeumbppj0bN5kL9ylPztvGx77Fe8PjRHwb+3wm0OT5PDg43QI8qSVf7vgbpo8d5qW4y5u8fOZSU1NeW+M9IL9y+buc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=NyCP/LBm; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="NyCP/LBm" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-47d6c634f45so1895659f8f.3 for ; Tue, 07 Jul 2026 06:05:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1783429504; x=1784034304; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=3d4naNwliegYgq2K0huOMXiCiQlPCGFE/pZd9JT8Ek8=; b=NyCP/LBmUgFTcGXG+pxAJZI+ONnMiPBYDs3VFhzZObnvUZ2bylyYpSzToIcPVmERLi fqaSjnOBKVlcPMtE2kIOl8Q8UonMdLRT5hiMplCJC+yKuLuhndVV26j0+0fof1UfDbgE wbd0WMnUo/6E/ZWjWlgJ+mWJoAi6GnmVVt2SiLJTuV9ualDM2sQ+/HNws05TMwKE4j84 KaDZP/RTbqrYbO+rs3dVC1Bq9EvE9R3Y+T5F80rIGqZw18gJPAlpKD9mJJ/avxmfiouN IRyL+DmffXb45w0p0V1lTu8ZDwPOfImQUvmTwR1ri5XS3Qig0h45Gy4yWLV+h/nRc8xD sbKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783429504; x=1784034304; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3d4naNwliegYgq2K0huOMXiCiQlPCGFE/pZd9JT8Ek8=; b=eMJ/dV+/6A40XJcA8n0KL27RP4gbX+BSrfcPZ5mKWsKn6oPKsjZ4P/4H6KixyAmM+p llyRvVZQAdQh1/G2Z1yZY5H+jp9V9Hz31RJAm+duUvLQulXDIS7if8xZ/p7lm3cO85C8 ltwXvk+sW+4sXQhutqls/BkTDtZ2nKpTIgwM4uWa3I4fUmkDHfRO22SZZKm2JVnLBBqh JIxn9L9lM4ZOfaWifmGIJ6a2p3EivKUTLUoA0ePrDLiT9Sg3AtHVA59MP2angwrbLuWm JX4M56TQ6sJq9w6EHc7KKFdrcIofAalFgwksc1D5royYqgnIhK/ysCFis950r5DhpHM9 gmKw== X-Forwarded-Encrypted: i=1; AHgh+Rq1Qh+7Cs+y9ofYjoZgerM96MKXPsZdq0vEBu9iUMHvM/uwUNqeKzJFWBeQ29icsMqzWbOsFtieWhmYwro=@vger.kernel.org X-Gm-Message-State: AOJu0Yw3z69PrSb8A7V+Ir0Lw/5HGnqO3/CwloxZOCQQGT+kByIgqS9s pICDT0nmKS5qvvermDy+oVQis+BLy2dCCil+aX9LyhEBsqHA68gurVodl8enieM/dpI= X-Gm-Gg: AfdE7cmoEzS529aAQ7gkXvqIO/9B8BDvmOzNkFHG6lMG2ktclNx+i/7bqgKO7p7O/6u NuTEO4pXJo4u6GVI/9yhkBUS0eEkJKlvqar3y92gLS7erAhcLdFUFvWbbXMiOP0t2DkdFa9wsGI +SJo8TwPxDQLhXq2LrsfgDeBKoc2e2nnapkSIGLyrqeomH3pn76EJrr6wR/HszSAPu1C28TwJPX bDkBFArcxEavPJAw+BkHXEYgg5mZm+4oZjqZ/gVlE4ORD765CpiGvgU4gDQvPHXhsd9lRxgMNBg gL3xT9bSzJyz/ZT9uQzqfT2m+kUNvZDrbKKgtPP9l4XbUF43gGiOKaFjsdTh2oXBbiAWUv9T+RH hehwcFOd4PNEd/3DV4bV93DEzgYbXSlf/74wy0VaQ9OpWx1XphcrsbZ7S0f7ivRfGd/EpD0auPy zF97uhY3i1bc6Iatk= X-Received: by 2002:a05:6000:1818:b0:475:f0c2:5afb with SMTP id ffacd0b85a97d-47de66dc604mr4565470f8f.49.1783429502942; Tue, 07 Jul 2026 06:05:02 -0700 (PDT) Received: from pathway.suse.cz ([176.114.240.130]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47a9de1d905sm34202966f8f.2.2026.07.07.06.05.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 07 Jul 2026 06:05:02 -0700 (PDT) Date: Tue, 7 Jul 2026 15:05:00 +0200 From: Petr Mladek To: John Ogness Cc: Sergey Senozhatsky , Steven Rostedt , linux-kernel@vger.kernel.org, Sashiko Subject: Re: [PATCH printk] printk: Fix possible console use-after-free Message-ID: References: <20260703141521.202813-1-john.ogness@linutronix.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260703141521.202813-1-john.ogness@linutronix.de> On Fri 2026-07-03 16:20:31, John Ogness wrote: > When emitting a record via legacy printing, it is possible that a handover > to another legacy printing context occurs. When a context has performed a > handover, the console SRCU read lock is released and the pointer to the > console struct might now be invalid. Therefore, after calling > nbcon_legacy_emit_next_record() or console_emit_next_record(), it is > necessary to check if a handover occurred _before_ further @con usage. > > Sashiko pointed out that console_flush_one_record() was not doing this. > > In console_flush_one_record(), after emitting a record, move the further > usage of @con after the handover check. > > Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()") > Reported-by: Sashiko > Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@smtp.kernel.org > Signed-off-by: John Ogness Great catch! The fix it straightfoward: Reviewed-by: Petr Mladek Now, the question is whether I should rush it into 7.2-rcX or it might wait for 7.3. IMHO, it can wait for 7.3 because it is very hard to trigger. All console drivers have "struct console" defined in the static .data section. It can disappear only when it is added as a module and the module gets removed. Which is a rather complicated and long process. Best Regards, Petr