Re: [PATCH net] net/dibs: Fix UAF of dmb_clientid_arr after dibs_dev_del()

From
Jakub Kicinski <kuba@kernel.org>
Date
2026-08-07 22:00:20
Also in
linux-s390, lkml, stable
Reply to
Alexandra Winter, 2026-08-07
On Fri, 7 Aug 2026 16:07:53 +0200 Alexandra Winter wrote:
quoted
[Severity: High]
These are the two failure returns that reach the loopback err_reg path
described above: device_add() returning an error (-ENOMEM, or a
kobject_add()/duplicate-name failure) and sysfs_create_group() returning
-ENOMEM.  In both cases dmb_clientid_arr is still allocated and not NULLed,
so the caller-side kfree() and dibs_dev_release() both free it.  The
kzalloc-failure case is fine because the pointer is still NULL.
Same as above (?)

[PATCH net v2] dibs: fix double free of dmb_clientid_arr
is in discussion on the netdev mailinglist already.
Please don't expect me to fish out such codependent patches
magically without so much as a note in the commit msg.
You have to repost this, and please do a better job of grouping 
the fixes going forward :/ This is a waste of time for both of us.
Thread (5 messages) 5 messages, 3 authors, last reply 2026-08-07
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help