Re: [PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[Greg KH <gregkh@linuxfoundation.org>]

A: http://en.wikipedia.org/wiki/Top_post
Q: Were do I find info about this thing called top-posting?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?

A: No.
Q: Should I include quotations after my reply?

http://daringfireball.net/2007/07/on_top

On Thu, Sep 17, 2026 at 08:48:30PM +0530, Adarsh Das wrote:
> Hi,
> 
> Sorry, I wasn't aware of the Assisted-by tag before. Should I send a
> V2 with it?

Please do.

> For testing I ran syzbot's C repro with -smp 4 on master, with
> multiple parallel instances of the repro. I was able to reproduce
> the bug:
> 
>   BUG: KASAN: slab-use-after-free in kobject_uevent_env+
>   Read of size 8 at addr ffff88800fa7f090 by task kworker/u16:5
>   CPU: 3
>   Workqueue: ib-unreg-wq ib_unregister_work
>   Call Trace:
>     kasan_report
>     kobject_uevent_env+0xc71/0xd90
>     device_del+0x7c7/0xcf0
>     disable_device+0x1d2/0x260
>     __ib_unregister_device+0x26b/0x400
>     ib_unregister_work+0x19/0x30
>     worker_thread
>     kthread
>   Allocated by task 498:
>     uevent_net_init+0xe5/0x340
>     setup_net
>     copy_net_ns
>     unshare_nsproxy_namespaces
>     ksys_unshare
>   Freed by task 63:
>     kfree
>     ops_undo_list
>     cleanup_net
>     worker_thread
>   The buggy address belongs to the cache kmalloc-32 of size 32
> 
> With this patch applied, I ran the same repro repeatedly (including
> parallel runs) and did not see the KASAN error anymore.

Did syzbot also test this?

And I have no context here at all, sorry, please realize that some of us
get 1000+ emails a day...

thanks,

greg k-h