# Re: \[PATCH net\] slip: fix use-after-free in sl\_sync()

- From: Jakub Kicinski \<kuba@kernel.org\>
- Date: 2026-08-20 20:59:22 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/08/17442118
- Thread: https://ratatoskr.run/netdev/2026/08/17420234/t.md

```text
On Mon, 17 Aug 2026 10:09:52 +0300 Aleksandr Khromov wrote:
> slip_devs[] stores bare net_device pointers and takes no reference on
> them.  sl_sync() and sl_alloc() walk that table from slip_open() under
> rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
> sl_setup() installs as dev->priv_destructor.

Would it not be a much simpler fix to move the deinit to ndo_uninit
if we need rtnl_lock?
-- 
pw-bot: cr
```