Re: [PATCH] klist: avoid accesses after waking klist_remove()

On Tue, Aug 25, 2026 at 09:03:25AM +0200, Karl Mehltretter wrote:
> On Tue, Aug 25, 2026 at 07:25:48AM +0100, Greg Kroah-Hartman wrote:
> > > to go out of scope and its caller to free or reuse the node.
> > 
> > But does that ever actually happen?
> 
> klist_remove() waits until the node is removed so the containing object can
> be freed. bus_remove_driver() can later free drv->p, while device_move()
> immediately adds the same node to another list.
> 
> > > The task reference keeps the waiter task alive if it returns and exits
> > > before wake_up_process(). wake_up_process() provides the full barrier
> > > required by the sleep/wakeup protocol, so remove the explicit mb().
> > 
> > I'm confused, what actual bug is here?
> 
> I found this during a targeted klist.c review.
> 
> Only later I cam across the syzbot report. That report became too prominent
> in the commit message.
> 
> klist_release() sets waiter->woken, then reads waiter->process and later
> writes n->n_klist. After seeing woken, the waiter can return on another CPU.
> 
> My initial KASAN reproducer was klist-only. One thread held an iterator while
> another removed and freed the object. A delay after the wakeup made
> the race easy, hit KASAN on n_klist in qemu arm64. 

Yes, but real-world use causes this in the kernel today?

> 
> > > Closes: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
> > > Tested-by: [email protected]
> > 
> > Are you sure?  the whole bind/unbind mess that syzbot is throwing at us
> > right now is really causing people to go down odd paths in thinking it's
> > even a valid thing to consider at all.
> 
> I did not verify the dummy_udc bind/unbind sequence. The klist issue
> does not depend on this USB path.
> 
> I can reword a v2 around the generic reproducer. anything else I should
> investigate before sending it ?

Again, what user of this api in the kernel is causing this type of
problem to require these changes?

thanks,

greg k-h