Re: [PATCH] refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors

From: Peter Zijlstra

Date: Tue Sep 29 2026 - 10:31:34 EST


On Wed, Aug 12, 2026 at 08:56:38PM +0200, Jann Horn wrote:
> Some refcount issues are not necessarily associated with memory corruption,
> but REFCOUNT_ADD_UAF suggests that a UAF either just happened or is about
> to happen.
>
> REFCOUNT_SUB_UAF is also an indicator that reference counting is wrong, and
> suggests (less strongly) that a UAF access might have happened recently.
>
> In these cases, BUG() is appropriate if CONFIG_BUG_ON_DATA_CORRUPTION is
> set.
>
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> ---
> MAINTAINERS specifies no specific maintainer for lib/refcount.c, but it
> does have an entry for include/linux/refcount.h, so I guess I should
> route this patch based on that.

Right, I'll stick this in tip/locking/core, where most all atomic things
go. Thanks!