Re: [PATCH] alarmtimer: Fix use-after-free of timerqueue node in alarmtimer_suspend()

[Thomas Gleixner]

On Mon, Mar 30 2026 at 14:15, Zhan Xusheng wrote:
> In alarmtimer_suspend(), the timerqueue_node pointer 'next' is obtained
> under base->lock via scoped_guard(), but its members (next->expires)
> are accessed after the lock has been released when the scoped_guard
> goes out of scope.
>
> Between the lock release and the dereference, a concurrent timer
> cancellation on another CPU could remove and free the timerqueue node,
> leading to a use-after-free.

That's correct in theory, but it's a made up scenario as this runs
during suspend after all processes which could remove and free it have
been frozen already.

That said, I have no objections against the patch per se, but I'm not
accepting the unrealistic argument backing it up.

Using AI is fine, but taking the output at face value is not.

Thanks,

        tglx