linux-kernel - Re: ipc/mqueue: release spinlock before freeing node_cache in mqueue_evict

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250703081051.GK1880847@ZenIV>
Date: Thu, 3 Jul 2025 09:10:51 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: ritu pal <ritupal888@...il.com>
Cc: linux-kernel@...r.kernel.org, Christian Brauner <brauner@...nel.org>,
	NeilBrown <neil@...wn.name>, Chen Ni <nichen@...as.ac.cn>
Subject: Re: ipc/mqueue: release spinlock before freeing node_cache in
 mqueue_evict_inode()

On Thu, Jul 03, 2025 at 01:34:39PM +0530, ritu pal wrote:
> > That spinlock is inside the inode in question; what exactly is going to be
> > on the other side of contention?  Note that none of the file methods
> > are going to run concurrent with that...
> 
> Another thread that's waiting to acquire the spinlock to process the
> next item in the mqueue.
> This change reduces the hold time of "info->lock", since the kfree()
> of the node_cache does not require a spinlock to be held.

Describe the call chain in that other thread, please.  If there is one,
you've got a UAF scenario.