On Wed, Feb 23, 2022 at 11:06:03AM -0800, Linus Torvalds wrote: > And as such, you not only can't dereference it, but you also shouldn't > even compare pointer values - because the pointer arithmetic that was > valid for loop entries is not valid for the HEAD entry that is > embedded in another type. So the pointer arithmetic might have turned > it into a pointer outside the real container of the HEAD, and might > actually match something else. Yes, this is what I had put together as well about this patch, and I think it is OK as-is. In this case the list head is in the .bss of a module so I don't think it is very likely that the type confused container_of() will alias a kalloc result, but it is certainly technically wrong as-is. > So elsewhere I suggested that the fix to "you can't use the pointer > outside the loop" be made to literally disallow it (using C99 for-loop > variables seems the cleanest model), and have the compiler refuse to > touch code that tries to use the loop iterator outside. Oh yes, that would be really nice solution. Jason
