linux-kernel - Re: [PATCH] staging: most: video: fix potential race in list iteration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aYMS_9xQ4LGgMS-j@stanley.mountain>
Date: Wed, 4 Feb 2026 12:35:59 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Minu Jin <s9430939@...er.com>
Cc: parthiban.veerasooran@...rochip.com, christian.gromm@...rochip.com,
	gregkh@...uxfoundation.org, hverkuil+cisco@...nel.org,
	laurent.pinchart+renesas@...asonboard.com,
	linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] staging: most: video: fix potential race in list
 iteration

On Tue, Feb 03, 2026 at 08:28:00PM +0900, Minu Jin wrote:
> There is a pattern in the loops where the lock is dropped
> to call a specific function and then re-acquired.
> 
> The list can be exposed during this short gap, creating a potential
> race condition. This patch fixes the problem by moving nodes to a
> local list while holding the lock, instead of using the
> unlock/lock pattern in the loop.
> 
> Signed-off-by: Minu Jin <s9430939@...er.com>
> ---
>  drivers/staging/most/video/video.c | 22 ++++++++++++++--------
>  1 file changed, 14 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
> index 32f71d9a9cf7..e7db58e5746a 100644
> --- a/drivers/staging/most/video/video.c
> +++ b/drivers/staging/most/video/video.c
> @@ -121,6 +121,7 @@ static int comp_vdev_close(struct file *filp)
>  	struct comp_fh *fh = to_comp_fh(filp);
>  	struct most_video_dev *mdev = fh->mdev;
>  	struct mbo *mbo, *tmp;
> +	LIST_HEAD(free_list);
>  
>  	/*
>  	 * We need to put MBOs back before we call most_stop_channel()
> @@ -134,12 +135,15 @@ static int comp_vdev_close(struct file *filp)
>  	spin_lock_irq(&mdev->list_lock);
>  	mdev->mute = true;
>  	list_for_each_entry_safe(mbo, tmp, &mdev->pending_mbos, list) {
> -		list_del(&mbo->list);
> -		spin_unlock_irq(&mdev->list_lock);
> -		most_put_mbo(mbo);
> -		spin_lock_irq(&mdev->list_lock);
> +		list_move(&mbo->list, &free_list);
>  	}

This loop moves ever single item in the list one by one.  You could
do it in one step instead by copying the list_head and setting
pending_mbos to point to itself.

Same in other loop.

regards,
dan carpenter