Re: [PATCH net] net/dibs: Fix UAF of dmb_clientid_arr after dibs_dev_del()

From
Simon Horman <horms@kernel.org>
Date
2026-08-06 13:02:42
Also in
linux-s390, lkml, stable
Reply to
Alexandra Winter, 2026-08-04
On Tue, Aug 04, 2026 at 10:58:48AM +0200, Alexandra Winter wrote:
A dibs device interrupt handler can be active after dibs_dev_del() and
may still access dmb_clientid_arr.

Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.
Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok
for now, because no dmbs can be registered before dibs_dev_add().

Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
Cc: <redacted>
Co-developed-by: Hidayath Khan <hidayath@linux.ibm.com>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Thread (5 messages) 5 messages, 3 authors, last reply 2026-08-07
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help