# Re: \[PATCH net\] net/dibs: Fix UAF of dmb\_clientid\_arr after dibs\_dev\_del()

- From: Simon Horman \<horms@kernel.org\>
- Date: 2026-08-06 13:02:42 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/08/17376209
- Thread: https://ratatoskr.run/netdev/2026/08/17362328/t.md

```text
On Tue, Aug 04, 2026 at 10:58:48AM +0200, Alexandra Winter wrote:
> A dibs device interrupt handler can be active after dibs_dev_del() and
> may still access dmb_clientid_arr.
> 
> Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.
> Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok
> for now, because no dmbs can be registered before dibs_dev_add().
> 
> Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
> Cc: <redacted>
> Co-developed-by: Hidayath Khan <hidayath@linux.ibm.com>
> Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
> Signed-off-by: Alexandra Winter <wintera@linux.ibm.com>

Reviewed-by: Simon Horman <horms@kernel.org>

```