Re: [PATCH net] net/xen-netback: prevent UAF in xenvif_flush_hash()

[Jakub Kicinski <kuba@xxxxxxxxxx>]

On Wed, 28 Aug 2024 21:52:12 +0900 Jeongjun Park wrote:
> > The loop runs with irq disabled, the RCU critical section extends over
> > it, uninterrupted.  
> 
> Basically, list_for_each_entry_rcu is specified to be used under the 
> protection
> of rcu_read_lock(), but this is not the case with xenvif_new_hash(). If it is
> used without the protection of rcu_read_lock(), kfree is called immediately
> after the grace period ends after the call to kfree_rcu() inside
> list_for_each_entry_rcu, so the entry is released, and a UAF occurs when
> fetching with ->next thereafter.

You cut off and didn't answer Paolo's question whether you have a splat
/ saw this actually cause a crash or a KASAN warning.