On 20 Feb 11:19, Yu Kuai wrote: > > Hi, > > 在 2025/02/20 11:05, Guillaume Morin 写道: > > how it was guaranteed that mddev_get() would fail as mddev_free() does not check or synchronize with the active atomic > > Please check how mddev is freed, start from mddev_put(). There might be > something wrong, but it's not what you said. I will take a look. Though if you're confident that this logic protects any uaf, that makes sense to me. However as I mentioned this is not what the crash was about (I mentioned the UAF in passing). The GPF seems to be about deleting the _next_ pointer while iterating over all mddevs. The mddev_get on the current item is not going to help with this. -- Guillaume Morin <guillaume@xxxxxxxxxxx>
