Re: [PATCH] cuse: wait for pending RCU callbacks on module exit
Miklos Szeredi <[email protected]>
| Newsgroups | gmane.linux.file-systems,gmane.linux.kernel |
|---|---|
| Message-ID | <CAJfpegvKQrOGAFCDidFeELrQb08sebJVo=WHXB5SoWAwjodSKA@mail.gmail.com> |
On Fri, 14 Aug 2026 at 15:40, Baokun Li <[email protected]> wrote: > > Since commit 053fc4f755ad ("fuse: fix UAF in rcu pathwalks"), > fuse_conn_put() frees the fuse_conn through call_rcu() rather than > synchronously. For cuse, fc->release is cuse_fc_release(), which > lives in the cuse module. If the module is removed before the RCU > grace period ends, the callback jumps into freed module memory: free_module() calls synchronize_rcu(), so this should not be an issue. Thanks, Miklos