[lvc-project] [PATCH net] slip: fix use-after-free in sl_sync()

Jakub Kicinski kuba at kernel.org
Thu Aug 20 23:59:20 MSK 2026


On Mon, 17 Aug 2026 10:09:52 +0300 Aleksandr Khromov wrote:
> slip_devs[] stores bare net_device pointers and takes no reference on
> them.  sl_sync() and sl_alloc() walk that table from slip_open() under
> rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
> sl_setup() installs as dev->priv_destructor.

Would it not be a much simpler fix to move the deinit to ndo_uninit
if we need rtnl_lock?
-- 
pw-bot: cr



More information about the lvc-project mailing list