From f773c49ce2b160e756acc088c7a9c24c2b7878cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=99=88=E9=82=A3=E5=87=A0?= <2078634206@qq.com>
Date: Sat, 22 Aug 2026 01:01:52 +0800
Subject: [PATCH] tkernel: killhook: keep hook list order independent of
 registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

register_kill_hook() maintains a priority-ordered list, but
its two insertion paths disagree about the order: the
in-loop path inserts a hook before the first entry with a
higher priority (ascending order, LOW first), while the
fallback path uses list_add_rcu() on the list head, which
places the hook at the front (descending order, HIGH first).

The resulting iteration order of call_kill_hook() therefore
depends on module load order: with kill_block (LOW) loaded
before kill_protect (HIGH) the list is [HIGH, LOW], loaded
the other way it is [LOW, HIGH].  Since the first hook
returning nonzero short-circuits the rest, whether a HIGH
priority hook actually gets to decide on a signal is an
accident of registration order.

Use list_add_tail_rcu() for the fallback insertion so the
list is always ascending by priority and the iteration
order no longer depends on registration order.

Upstream status: downstream-only

Signed-off-by: 陈那几 <2078634206@qq.com>
---
 kernel/tkernel/killhook/kill_hook.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/tkernel/killhook/kill_hook.c b/kernel/tkernel/killhook/kill_hook.c
index 6a9d4a841254..dbef3077b85b 100644
--- a/kernel/tkernel/killhook/kill_hook.c
+++ b/kernel/tkernel/killhook/kill_hook.c
@@ -41,7 +41,7 @@ int register_kill_hook(struct kill_hook *hook)
 			return 0;
 		}
 	}
-	list_add_rcu(&hook->node, &kill_hook_list);
+	list_add_tail_rcu(&hook->node, &kill_hook_list);
 	spin_unlock(&kill_hook_lock);
 
 	return 0;
-- 
Gitee