Re: [PATCH net v2 2/2] netconsole: read np.dev under the RTNL in local_mac_show()

[Breno Leitao <leitao@debian.org>]

Hello Gustavo,

On Tue, Oct 06, 2026 at 07:21:26PM +0100, Gustavo Luiz Duarte wrote:
> local_mac_show() loads nt->np.dev and dereferences it with no lock. It
> can race with the interface going away and netconsole_netdev_event()
> eventually calling netdev_put() and freeing the device before we
> dereference it, leading to a UAF.

Thanks for the fix.

> --- a/drivers/net/netconsole.c
> +++ b/drivers/net/netconsole.c
> @@ -888,10 +888,17 @@ static ssize_t remote_ip_show(struct config_item *item, char *buf)
>  
>  static ssize_t local_mac_show(struct config_item *item, char *buf)
>  {
> -	struct net_device *dev = to_target(item)->np.dev;
>  	static const u8 bcast[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
> +	struct netconsole_target *nt = to_target(item);
> +	int ret;
>  
> -	return sysfs_emit(buf, "%pM\n", dev ? dev->dev_addr : bcast);
> +	/* Hold RTNL here so netconsole_netdev_event() doesn't tear down np.dev
> +	 * from under us.
> +	 */
> +	rtnl_lock();

Same idea as Eric suggested earlier, this might be doable without having
the heavy RTNL, but using netconsole's locks

--breno