Re: [PATCH net] net/dibs: Fix UAF of dmb_clientid_arr after dibs_dev_del()
Simon Horman <[email protected]>
| Newsgroups | org.kernel.vger.linux-s390,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Tue, Aug 04, 2026 at 10:58:48AM +0200, Alexandra Winter wrote:
> A dibs device interrupt handler can be active after dibs_dev_del() and
> may still access dmb_clientid_arr.
>
> Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.
> Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok
> for now, because no dmbs can be registered before dibs_dev_add().
>
> Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
> Cc: [email protected]
> Co-developed-by: Hidayath Khan <[email protected]>
> Signed-off-by: Hidayath Khan <[email protected]>
> Signed-off-by: Alexandra Winter <[email protected]>
Reviewed-by: Simon Horman <[email protected]>