]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
net: prevent possible UAF in rtnl_prop_list_size()
authorEric Dumazet <edumazet@google.com>
Sat, 2 May 2026 12:41:02 +0000 (12:41 +0000)
committerJakub Kicinski <kuba@kernel.org>
Tue, 5 May 2026 02:24:27 +0000 (19:24 -0700)
commitac0841d7d202073415c808bda7848502163b87dd
tree0abcafa9d26884a1cf093206594796af69b370ef
parent9d7ebff0c3d90ff7abdb7a77c5906b3c870f70cf
net: prevent possible UAF in rtnl_prop_list_size()

I was mistaken by synchronize_rcu() [1] call in netdev_name_node_alt_destroy(),
giving a false sense of RCU safety at delete times.

We have to use list_del_rcu() to not confuse potential readers
in rtnl_prop_list_size().

[1] This synchronize_rcu() call was later removed in commit 723de3ebef03
("net: free altname using an RCU callback").

Fixes: 9f30831390ed ("net: add rcu safety to rtnl_prop_list_size()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260502124102.499204-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/core/dev.c