From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very beginning. kfree_rcu is only invoked if atomic_dec_and_test returns 1. How come two threads become racy then? Where is ctx getting used after the free operation?


You must log in to answer this question.

Browse other questions tagged .