Re: driver core: uevent: netns teardown frees uevent_sock while a tagged uevent is still being broadcast (UAF)

[Greg KH <greg@kroah.com>]

On Tue, Nov 10, 2026 at 09:00:29PM +0800, 徐晗翔 wrote:
> net->uevent_sock is published as a bare pointer by uevent_net_init()
> and freed by uevent_net_exit(), but the tagged broadcast path
> dereferences net->uevent_sock->sk without holding uevent_sock_mutex or
> taking a socket reference.  uevent_net_exit() drops the mutex before
> releasing the socket and never clears net->uevent_sock, so a kobject
> whose namespace callback returns an unpinned net pointer can emit a
> tagged uevent after the per-net exit has freed the socket; KASAN
> reports a slab-use-after-free read in kobject_uevent_net_broadcast()
> (inlined into kobject_uevent_env in the report below).
> 
> An IB compat device supplies a concrete path.  Its rdma_net is a raw
> possible_net_t, and its asynchronous unregister can still be inside
> device_del() after the net namespace has run uevent_net_exit().  This
> was reported by syzbot (KASAN: slab-use-after-free Read in
> disable_device, extid 4393dfdddf166f2de2b0,
> https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0) and I
> reproduced it locally on 7.3 with a KASAN kernel; the same reproducer
> is clean with a no-rxe control and with the v4 locking change described
> below.
> 
> The detailed description:
> 
> * Test environment / affected version
> 
>   Linux 7.3.0 (vanilla mainline tarball), x86_64, QEMU/KVM guest,
>   8 vCPU / 4 GB RAM, KASAN generic.  The tested
>   lib/kobject_uevent.c is byte-identical to the audited 7.3 tree
>   (sha256 bbcf120ea86f42c74dec10e255a8cd0b3034c9f34cd5bb911fd94015729dd076).
>   Kernel config included CONFIG_NET_NS=y, CONFIG_INFINIBAND=y,
>   CONFIG_INFINIBAND_USER_ACCESS=y, CONFIG_RDMA_RXE=y, CONFIG_DUMMY=y
>   and CONFIG_KASAN=y.  The kernel source was not modified to inject
>   the race; only the IB/RXE configuration was enabled and a userspace
>   reproducer was added.

No patch?