From: Eric Dumazet <edumazet@google.com>
Date: Sat, 2 May 2026 12:41:02 +0000 (+0000)
Subject: net: prevent possible UAF in rtnl_prop_list_size()
X-Git-Tag: v7.1-rc3~26^2~40
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ac0841d7d202073415c808bda7848502163b87dd;p=thirdparty%2Flinux.git

net: prevent possible UAF in rtnl_prop_list_size()

I was mistaken by synchronize_rcu() [1] call in netdev_name_node_alt_destroy(),
giving a false sense of RCU safety at delete times.

We have to use list_del_rcu() to not confuse potential readers
in rtnl_prop_list_size().

[1] This synchronize_rcu() call was later removed in commit 723de3ebef03
("net: free altname using an RCU callback").

Fixes: 9f30831390ed ("net: add rcu safety to rtnl_prop_list_size()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260502124102.499204-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---

diff --git a/net/core/dev.c b/net/core/dev.c
index 06c195906231..8bfa8313ef62 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -371,7 +371,7 @@ static void netdev_name_node_alt_free(struct rcu_head *head)
 static void __netdev_name_node_alt_destroy(struct netdev_name_node *name_node)
 {
 	netdev_name_node_del(name_node);
-	list_del(&name_node->list);
+	list_del_rcu(&name_node->list);
 	call_rcu(&name_node->rcu, netdev_name_node_alt_free);
 }