Re: [PATCH net] net: vlan: fix a UAF in vlan_dev_real_dev()

On Fri, Oct 29, 2021 at 06:46:10AM -0700, Jakub Kicinski wrote:

On Fri, 29 Oct 2021 09:13:24 -0300 Jason Gunthorpe wrote:

quoted

Jakub's path would be to test vlan_dev->reg_state != NETREG_REGISTERED
in the work queue, but that feels pretty hacky to me as the main point
of the UNREGISTERING state is to keep the object alive enough that
those with outstanding gets can compelte their work and release the
get. Leaving a wrecked object in UNREGISTERING is a bad design.

That or we should investigate if we could hold the ref for real_dev all
the way until vlan_dev_free().

The latter is certainly better if it works out, no circular deps, etc.

Thanks,
Jason