On 8/22/24 20:11, Jeongjun Park wrote:
During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if
The above wording is confusing, do you mean "kfree_rcu does not exit from "...?
kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free.
The loop runs with irq disabled, the RCU critical section extends over it, uninterrupted.
Do you have a splat for the reported UAF? This does not look the correct solution. Thanks, Paolo
