Re: [PATCH v0] mctp: defer the kfree of object mdev->addrs

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Fri, 22 Apr 2022 19:43:40 +0800 you wrote:
> The function mctp_unregister() reclaims the device's relevant resource
> when a netcard detaches. However, a running routine may be unaware of
> this and cause the use-after-free of the mdev->addrs object.
> 
> The race condition can be demonstrated below
> 
>  cleanup thread               another thread
>                           |
> unregister_netdev()       |  mctp_sendmsg()
> ...                       |    ...
>   mctp_unregister()       |    rt = mctp_route_lookup()
>     ...                   |    mctl_local_output()
>     kfree(mdev->addrs)    |      ...
>                           |      saddr = rt->dev->addrs[0];
>                           |
> 
> [...]

Here is the summary with links:
  - [v0] mctp: defer the kfree of object mdev->addrs
    https://git.kernel.org/netdev/net/c/b561275d633b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html