[PATCH net] net: prevent possible UAF in rtnl_prop_list_size()

[PATCH net] net: prevent possible UAF in rtnl_prop_list_size()

[Eric Dumazet]

I was mistaken by synchronize_rcu() [1] call in netdev_name_node_alt_destroy(),
giving a false sense of RCU safety at delete times.

We have to use list_del_rcu() to not confuse potential readers
in rtnl_prop_list_size().

[1] This synchronize_rcu() call was later removed in commit 723de3ebef03
("net: free altname using an RCU callback").

Fixes: 9f30831390ed ("net: add rcu safety to rtnl_prop_list_size()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/core/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 06c195906231a39ef58dfff299964a3419d87c88..8bfa8313ef62eda9fe6aa037c6a5408df54e91cf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -371,7 +371,7 @@ static void netdev_name_node_alt_free(struct rcu_head *head)
 static void __netdev_name_node_alt_destroy(struct netdev_name_node *name_node)
 {
 	netdev_name_node_del(name_node);
-	list_del(&name_node->list);
+	list_del_rcu(&name_node->list);
 	call_rcu(&name_node->rcu, netdev_name_node_alt_free);
 }
 
-- 
2.54.0.545.g6539524ca2-goog

Re: [PATCH net] net: prevent possible UAF in rtnl_prop_list_size()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sat,  2 May 2026 12:41:02 +0000 you wrote:
> I was mistaken by synchronize_rcu() [1] call in netdev_name_node_alt_destroy(),
> giving a false sense of RCU safety at delete times.
> 
> We have to use list_del_rcu() to not confuse potential readers
> in rtnl_prop_list_size().
> 
> [1] This synchronize_rcu() call was later removed in commit 723de3ebef03
> ("net: free altname using an RCU callback").
> 
> [...]

Here is the summary with links:
  - [net] net: prevent possible UAF in rtnl_prop_list_size()
    https://git.kernel.org/netdev/net/c/ac0841d7d202

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html