Re: [PATCH printk] printk: Fix possible console use-after-free

[Petr Mladek]

On Fri 2026-07-03 16:20:31, John Ogness wrote:
> When emitting a record via legacy printing, it is possible that a handover
> to another legacy printing context occurs. When a context has performed a
> handover, the console SRCU read lock is released and the pointer to the
> console struct might now be invalid. Therefore, after calling
> nbcon_legacy_emit_next_record() or console_emit_next_record(), it is
> necessary to check if a handover occurred _before_ further @con usage.
> 
> Sashiko pointed out that console_flush_one_record() was not doing this.
> 
> In console_flush_one_record(), after emitting a record, move the further
> usage of @con after the handover check.
> 
> Fixes: c158834b223f ("printk: nbcon: Use nbcon consoles in console_flush_all()")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://lore.kernel.org/lkml/20260630170903.099D61F000E9@xxxxxxxxxxxxxxx
> Signed-off-by: John Ogness <john.ogness@xxxxxxxxxxxxx>

Great catch!

The fix it straightfoward:

Reviewed-by: Petr Mladek <pmladek@xxxxxxxx>

Now, the question is whether I should rush it into 7.2-rcX or
it might wait for 7.3.

IMHO, it can wait for 7.3 because it is very hard to trigger.
All console drivers have "struct console" defined in the static .data
section. It can disappear only when it is added as a module and
the module gets removed. Which is a rather complicated and long
process.

Best Regards,
Petr