From: Adarsh Das <adarshdas950@gmail.com>
To: gregkh@linuxfoundation.org
Cc: dakr@kernel.org, driver-core@lists.linux.dev,
linux-kernel@vger.kernel.org, rafael@kernel.org,
stable@vger.kernel.org,
syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com
Subject: Re: [PATCH] kobject: fix uevent socket use-after-free on net namespace delete
Date: Thu, 17 Sep 2026 20:48:30 +0530 [thread overview]
Message-ID: <20260917151830.89024-1-adarshdas950@gmail.com> (raw)
In-Reply-To: <2026091756-widen-doozy-399c@gregkh>
Hi,
Sorry, I wasn't aware of the Assisted-by tag before. Should I send a
V2 with it?
For testing I ran syzbot's C repro with -smp 4 on master, with
multiple parallel instances of the repro. I was able to reproduce
the bug:
BUG: KASAN: slab-use-after-free in kobject_uevent_env+
Read of size 8 at addr ffff88800fa7f090 by task kworker/u16:5
CPU: 3
Workqueue: ib-unreg-wq ib_unregister_work
Call Trace:
kasan_report
kobject_uevent_env+0xc71/0xd90
device_del+0x7c7/0xcf0
disable_device+0x1d2/0x260
__ib_unregister_device+0x26b/0x400
ib_unregister_work+0x19/0x30
worker_thread
kthread
Allocated by task 498:
uevent_net_init+0xe5/0x340
setup_net
copy_net_ns
unshare_nsproxy_namespaces
ksys_unshare
Freed by task 63:
kfree
ops_undo_list
cleanup_net
worker_thread
The buggy address belongs to the cache kmalloc-32 of size 32
With this patch applied, I ran the same repro repeatedly (including
parallel runs) and did not see the KASAN error anymore.
next prev parent reply other threads:[~2026-09-17 15:18 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-17 14:42 [PATCH] kobject: fix uevent socket use-after-free on net namespace delete Adarsh Das
2026-09-17 14:51 ` Greg KH
2026-09-17 15:18 ` Adarsh Das [this message]
2026-09-17 15:21 ` Greg KH
2026-09-17 17:08 ` [PATCH v2] " Adarsh Das
2026-09-17 17:08 ` Adarsh Das
2026-09-17 17:40 ` Greg KH
2026-09-18 6:08 ` [PATCH v3] " Adarsh Das
2026-09-18 8:14 ` Greg KH
2026-09-18 8:14 ` Greg KH
2026-09-18 9:43 ` [PATCH v4] " Adarsh Das
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260917151830.89024-1-adarshdas950@gmail.com \
--to=adarshdas950@gmail.com \
--cc=dakr@kernel.org \
--cc=driver-core@lists.linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.