From: Oleg Nesterov <oleg@redhat.com>
To: Joel Granados <joel.granados@kernel.org>
Cc: Allison Henderson <achender@kernel.org>,
kernel test robot <yi1.lai@intel.com>,
oe-lkp@lists.linux.dev, lkp@intel.com,
linux-kernel@vger.kernel.org, linux-m68k@lists.linux-m68k.org,
linux-s390@vger.kernel.org, linux-fsdevel@vger.kernel.org,
netdev@vger.kernel.org, wireguard@lists.zx2c4.com,
rds-devel@oss.oracle.com
Subject: Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map
Date: Tue, 20 Oct 2026 13:05:01 +0200 [thread overview]
Message-ID: <atdK3ZkT4YqjGICq@redhat.com> (raw)
In-Reply-To: <atdE-TB8hkqcwp6g@hobbes>
On 10/20, Joel Granados wrote:
>
> On Mon, Oct 19, 2026 at 12:52:58PM -0700, Allison Henderson wrote:
> >
> > CONFIG_SYSCTL=n. A simpler fix might be to just handle the NULL at the
> > three call sites, e.g.:
> >
> > rds_sysctl_reg_table =
> > register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
> > if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
> > return -ENOMEM;
> >
>
> Remember to NULL check rds_sysctl_reg_table in rds_sysctl_exit(). You
> might hit another UAF on exit if you don't.
Why? unregister_sysctl_table(header) does nothing if header == NULL.
Oleg.
next prev parent reply other threads:[~2026-10-20 11:05 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 1:46 [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map kernel test robot
2026-10-19 11:41 ` Oleg Nesterov
2026-10-19 13:30 ` Joel Granados
2026-10-19 14:49 ` Oleg Nesterov
2026-10-19 15:35 ` Oleg Nesterov
2026-10-19 19:52 ` Allison Henderson
2026-10-20 9:12 ` Oleg Nesterov
2026-10-20 10:51 ` Joel Granados
2026-10-20 10:43 ` Joel Granados
2026-10-20 11:05 ` Oleg Nesterov [this message]
2026-10-20 13:09 ` rds_wq UAF Oleg Nesterov
2026-10-20 9:06 ` [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map Joel Granados
2026-10-20 9:24 ` Oleg Nesterov
2026-10-20 7:55 ` Joel Granados
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atdK3ZkT4YqjGICq@redhat.com \
--to=oleg@redhat.com \
--cc=achender@kernel.org \
--cc=joel.granados@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-m68k@lists.linux-m68k.org \
--cc=linux-s390@vger.kernel.org \
--cc=lkp@intel.com \
--cc=netdev@vger.kernel.org \
--cc=oe-lkp@lists.linux.dev \
--cc=rds-devel@oss.oracle.com \
--cc=wireguard@lists.zx2c4.com \
--cc=yi1.lai@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox