# \[PATCH net\] net/dibs: Fix UAF of dmb\_clientid\_arr after dibs\_dev\_del() - From: Alexandra Winter \ - Date: 2026-08-04 08:59:00 - List: netdev - Page: https://ratatoskr.run/netdev/2026/08/17362328 - Thread: https://ratatoskr.run/netdev/2026/08/17362328/t.md ```text A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add(). Fixes: cc21191b584c ("dibs: Move data path to dibs layer") Cc: Co-developed-by: Hidayath Khan Signed-off-by: Hidayath Khan Signed-off-by: Alexandra Winter --- drivers/dibs/dibs_main.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/dibs/dibs_main.c b/drivers/dibs/dibs_main.c index 14c3e2d84902..f059fefb09bf 100644 --- a/drivers/dibs/dibs_main.c +++ b/drivers/dibs/dibs_main.c @@ -128,6 +128,7 @@ static void dibs_dev_release(struct device *dev) dibs = container_of(dev, struct dibs_dev, dev); + kfree(dibs->dmb_clientid_arr); kfree(dibs); } @@ -194,12 +195,13 @@ int dibs_dev_add(struct dibs_dev *dibs) ret = device_add(&dibs->dev); if (ret) - goto free_client_arr; + return ret; ret = sysfs_create_group(&dibs->dev.kobj, &dibs_dev_attr_group); if (ret) { dev_err(&dibs->dev, "sysfs_create_group failed for dibs_dev\n"); - goto err_device_del; + device_del(&dibs->dev); + return ret; } mutex_lock(&dibs_dev_list.mutex); mutex_lock(&clients_lock); @@ -214,13 +216,6 @@ int dibs_dev_add(struct dibs_dev *dibs) mutex_unlock(&dibs_dev_list.mutex); return 0; - -err_device_del: - device_del(&dibs->dev); -free_client_arr: - kfree(dibs->dmb_clientid_arr); - return ret; - } EXPORT_SYMBOL_GPL(dibs_dev_add); @@ -247,7 +242,6 @@ void dibs_dev_del(struct dibs_dev *dibs) mutex_unlock(&dibs_dev_list.mutex); device_del(&dibs->dev); - kfree(dibs->dmb_clientid_arr); } EXPORT_SYMBOL_GPL(dibs_dev_del); -- 2.53.0 ```