# Re: \[PATCH net\] net/dibs: Fix UAF of dmb\_clientid\_arr after dibs\_dev\_del()

- From: Jakub Kicinski \<kuba@kernel.org\>
- Date: 2026-08-07 22:00:20 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/08/17385242
- Thread: https://ratatoskr.run/netdev/2026/08/17362328/t.md

```text
On Fri, 7 Aug 2026 16:07:53 +0200 Alexandra Winter wrote:
> > [Severity: High]
> > These are the two failure returns that reach the loopback err_reg path
> > described above: device_add() returning an error (-ENOMEM, or a
> > kobject_add()/duplicate-name failure) and sysfs_create_group() returning
> > -ENOMEM.  In both cases dmb_clientid_arr is still allocated and not NULLed,
> > so the caller-side kfree() and dibs_dev_release() both free it.  The
> > kzalloc-failure case is fine because the pointer is still NULL.
> 
> Same as above (?)
> 
> [PATCH net v2] dibs: fix double free of dmb_clientid_arr
> is in discussion on the netdev mailinglist already.

Please don't expect me to fish out such codependent patches
magically without so much as a note in the commit msg.
You have to repost this, and please do a better job of grouping 
the fixes going forward :/ This is a waste of time for both of us.
```