Messages in this thread | | | Date | Mon, 23 Aug 2021 09:46:36 +0200 | From | Christoph Hellwig <> | Subject | Re: [PATCH] configfs: fix a race in configfs_lookup() |
| |
On Fri, Aug 20, 2021 at 05:44:58PM -0400, sishuaigong wrote: > When configfs_lookup() is executing list_for_each_entry(), > it is possible that configfs_dir_lseek() is calling list_del(). > Some unfortunate interleavings of them can cause a kernel NULL > pointer dereference error > > Thread 1 Thread 2 > //configfs_dir_lseek() //configfs_lookup() > list_del(&cursor->s_sibling); > list_for_each_entry(sd, ...) > > Fix this bug by using list_for_each_entry_safe() instead.
I don't see how list_for_each_entry_safe would save you there. You need a lock to sychronize the two, list_for_each_entry_safe only ensures the next entry is looked up before iterating over the current one.
| |