Re: [PATCH net] dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

[email protected] Thu, 30 Jul 2026 00:00:20 +0000

Newsgroups	org.kernel.vger.linux-rdma,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390,org.kernel.vger.netdev
Message-ID	<178536962038.3288516.6334881564101626025.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Mon, 27 Jul 2026 11:35:30 +0200 you wrote:
> dibs_lo_attach_dmb(), dibs_lo_detach_dmb() and dibs_lo_unregister_dmb()
> look up the dmb_node under dmb_ht_lock, drop the lock and only then
> operate on the node's refcount. Nothing keeps the node alive across
> that window: __dibs_lo_unregister_dmb() removes the node from the hash
> table under the write lock and immediately frees it.
> 
> A concurrent final put can therefore free the node between the lookup
> and the refcount operation:
> 
> [...]

Here is the summary with links:
  - [net] dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
    https://git.kernel.org/netdev/net/c/a10ea943356b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html