Re: [PATCH net] slip: fix use-after-free in sl_sync()
Jakub Kicinski <[email protected]>
| Newsgroups | org.kernel.vger.netdev,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Mon, 17 Aug 2026 10:09:52 +0300 Aleksandr Khromov wrote: > slip_devs[] stores bare net_device pointers and takes no reference on > them. sl_sync() and sl_alloc() walk that table from slip_open() under > rtnl_lock(), while an entry is dropped by sl_free_netdev(), which > sl_setup() installs as dev->priv_destructor. Would it not be a much simpler fix to move the deinit to ndo_uninit if we need rtnl_lock? -- pw-bot: cr