[PATCH] net/ncsi: Fix Use-After-Free in ncsi_remove_channel/package

[PATCH] net/ncsi: Fix Use-After-Free in ncsi_remove_channel/package

[Wong Boon Jhee]

From af39fbef05b309b7e183690dbb7e63295ff0be5a Mon Sep 17 00:00:00 2001
From: Wong Boon Jhee <wongboonjhee52@gmail.com>
Date: Thu, 13 Aug 2026 00:25:47 +0800
Subject: [PATCH] net/ncsi: Fix Use-After-Free in NCSI channel and package
 removal

In net/ncsi/ncsi-manage.c, ncsi_remove_channel() and
ncsi_remove_package() remove objects from an RCU-protected linked list
using list_del_rcu() and immediately free them using kfree().

Because there is no call to synchronize_rcu() or kfree_rcu(), concurrent
readers traversing these lists under rcu_read_lock() (such as Netlink
dump handlers) can still hold a valid pointer to the object. When kfree()
executes, the reader is left holding a dangling pointer to freed memory,
resulting in a slab-use-after-free.

This patch fixes the issue by replacing kfree() with kfree_rcu(), which
defers the memory freeing until all pre-existing RCU readers have finished
their critical sections. To support this, a struct rcu_head has been
added to struct ncsi_channel, struct ncsi_package, and struct ncsi_dev_priv.

KASAN confirms the freed object belongs to the kmalloc-96 cache, and the
fix completely eliminates the crash.

Fixes: 2d283bdd079c ("net/ncsi: Resource management")
Signed-off-by: Wong Boon Jhee <wongboonjhee52@gmail.com>
---
 net/ncsi/internal.h    | 2 ++
 net/ncsi/ncsi-manage.c | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
index adee6dcabdc3..19785ca2392a 100644
--- a/net/ncsi/internal.h
+++ b/net/ncsi/internal.h
@@ -239,6 +239,7 @@ struct ncsi_channel {
  } monitor;
  struct list_head            node;
  struct list_head            link;
+ struct rcu_head             rcu; /* RCU cleanup */
 };

 struct ncsi_package {
@@ -253,6 +254,7 @@ struct ncsi_package {
  bool                 multi_channel; /* Enable multiple channels  */
  u32                  channel_whitelist; /* Channels to configure */
  struct ncsi_channel  *preferred_channel; /* Primary channel      */
+ struct rcu_head      rcu; /* RCU cleanup */
 };

 struct ncsi_request {
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 54d0df0a9efe..368085627807 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -263,7 +263,7 @@ static void ncsi_remove_channel(struct ncsi_channel *nc)
  np->channel_num--;
  spin_unlock_irqrestore(&np->lock, flags);

- kfree(nc);
+ kfree_rcu(nc, rcu);
 }

 struct ncsi_package *ncsi_find_package(struct ncsi_dev_priv *ndp,
@@ -326,7 +326,7 @@ void ncsi_remove_package(struct ncsi_package *np)
  ndp->package_num--;
  spin_unlock_irqrestore(&ndp->lock, flags);

- kfree(np);
+ kfree_rcu(np, rcu);
 }

 void ncsi_find_package_and_channel(struct ncsi_dev_priv *ndp,
-- 
2.55.0

Re: [PATCH] net/ncsi: Fix Use-After-Free in ncsi_remove_channel/package

[Simon Horman]

On Thu, Aug 13, 2026 at 12:29:42AM +0800, Wong Boon Jhee wrote:
> From af39fbef05b309b7e183690dbb7e63295ff0be5a Mon Sep 17 00:00:00 2001
> From: Wong Boon Jhee <wongboonjhee52@gmail.com>
> Date: Thu, 13 Aug 2026 00:25:47 +0800
> Subject: [PATCH] net/ncsi: Fix Use-After-Free in NCSI channel and package
>  removal
> 
> In net/ncsi/ncsi-manage.c, ncsi_remove_channel() and
> ncsi_remove_package() remove objects from an RCU-protected linked list
> using list_del_rcu() and immediately free them using kfree().
> 
> Because there is no call to synchronize_rcu() or kfree_rcu(), concurrent
> readers traversing these lists under rcu_read_lock() (such as Netlink
> dump handlers) can still hold a valid pointer to the object. When kfree()
> executes, the reader is left holding a dangling pointer to freed memory,
> resulting in a slab-use-after-free.
> 
> This patch fixes the issue by replacing kfree() with kfree_rcu(), which
> defers the memory freeing until all pre-existing RCU readers have finished
> their critical sections. To support this, a struct rcu_head has been
> added to struct ncsi_channel, struct ncsi_package, and struct ncsi_dev_priv.
> 
> KASAN confirms the freed object belongs to the kmalloc-96 cache, and the
> fix completely eliminates the crash.
> 
> Fixes: 2d283bdd079c ("net/ncsi: Resource management")
> Signed-off-by: Wong Boon Jhee <wongboonjhee52@gmail.com>

Thanks for your patch.
Unfortunately, it does not seem to apply.

Please:

1. Rebase the patch on the current net tree

2. Target that tree when you resubmit the patch

   Subject: [PATCH net v2] ...

3. Include a changelog that describes this change

The b4 tool can help you.

-- 
pw-bot: changes-requested