Re: [PATCH net] dibs: fix use-after-free in dmb lookup functions

[Alexandra Winter <wintera@linux.ibm.com>]

On 29.05.26 09:08, Rahul Chandelkar wrote:
> From 68f633e58deb6edffa435a3b2bdc4a12a5e36daf Mon Sep 17 00:00:00 2001
> From: Rahul Chandelkar <rc@rexion.ai>
> Date: Fri, 29 May 2026 12:32:34 +0530
> Subject: [PATCH net] dibs: fix use-after-free in dmb lookup functions
> 
> dibs_lo_attach_dmb(), dibs_lo_detach_dmb(), and dibs_lo_unregister_dmb()
> all release read_lock_bh before operating on the dmb_node pointer found
> during hash table lookup. A concurrent unregister on the same token can
> kfree() the node in this window, causing a use-after-free when the
> original caller subsequently performs refcount_inc_not_zero() or
> refcount_dec_and_test() on the freed object.

As discussed off-list, there is no such problem in the current kernel, as there
is no such caller.
I fully agree that this should be improved, but this should go to [net-next]
as an improvement without a Fixes tag. (This matters, because it removes
the burden of backporting, porting to Stable etc..)

> 
> Fix by performing the refcount operation while still holding read_lock_bh,
> so the node cannot be freed between lookup and use. Release the lock
> before any code path that may call __dibs_lo_unregister_dmb(), since that
> function acquires write_lock_bh internally via hash_del().
> 
> Fixes: cb990a45d7f6 ("dibs: Define dibs loopback")
> Signed-off-by: Rahul Chandelkar <rc@rexion.ai>
> ---


Thank you very much for this patch, please allow for some more days
for me to review and test it.