Re: [PATCH] klist: avoid accesses after waking klist_remove()

[Karl Mehltretter <kmehltretter@gmail.com>]

On Tue, Aug 25, 2026 at 07:25:48AM +0100, Greg Kroah-Hartman wrote:
> > to go out of scope and its caller to free or reuse the node.
> 
> But does that ever actually happen?

klist_remove() waits until the node is removed so the containing object can
be freed. bus_remove_driver() can later free drv->p, while device_move()
immediately adds the same node to another list.

> > The task reference keeps the waiter task alive if it returns and exits
> > before wake_up_process(). wake_up_process() provides the full barrier
> > required by the sleep/wakeup protocol, so remove the explicit mb().
> 
> I'm confused, what actual bug is here?

I found this during a targeted klist.c review.

Only later I cam across the syzbot report. That report became too prominent
in the commit message.

klist_release() sets waiter->woken, then reads waiter->process and later
writes n->n_klist. After seeing woken, the waiter can return on another CPU.

My initial KASAN reproducer was klist-only. One thread held an iterator while
another removed and freed the object. A delay after the wakeup made
the race easy, hit KASAN on n_klist in qemu arm64. 

> > Closes: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
> > Tested-by: syzbot+9cb1ac7fce4944ba9165@syzkaller.appspotmail.com
> 
> Are you sure?  the whole bind/unbind mess that syzbot is throwing at us
> right now is really causing people to go down odd paths in thinking it's
> even a valid thing to consider at all.

I did not verify the dummy_udc bind/unbind sequence. The klist issue
does not depend on this USB path.

I can reword a v2 around the generic reproducer. anything else I should
investigate before sending it ?

Thanks,
Karl