Re: [PATCH] net: pktgen: fix proc entry use-after-free

[Simon Horman]

On Sun, Jul 19, 2026 at 10:57:40PM +0800, Chengfeng Ye wrote:
> pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.
> pktgen_remove_device() removes the same entry before
> _rem_dev_from_if_list() takes that lock.
> 
> This allows the following interleaving:
> 
>   CPU 0 (NETDEV_CHANGENAME)       CPU 1 (kpktgend)
>   if_lock(t)
>   proc_remove(pkt_dev->entry)
>                                   proc_remove(pkt_dev->entry)
>   pkt_dev->entry = proc_create_data(...)
>   if_unlock(t)
> 
> The kthread can pass the stale proc_dir_entry to proc_remove() after the
> rename path has freed it. A reproducer with a widened race window reports:
> 
>   BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80
>   Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67
>   Call Trace:
>    proc_remove+0x78/0x80
>    pktgen_remove_device.isra.0+0x11c/0x4c0
>    pktgen_thread_worker+0x1214/0x6bc0
>    kthread+0x2c6/0x3b0
>   Allocated by task 95:
>    __proc_create+0x204/0x790
>    proc_create_data+0x72/0xe0
>    pktgen_thread_write+0xd61/0x1510
>   Freed by task 28:
>    kmem_cache_free+0xcb/0x3d0
>    proc_free_inode+0x5b/0x80
>    rcu_core+0x50a/0x1850
>   The buggy address belongs to the object at ffff8881478fea00
>    which belongs to the cache proc_dir_entry of size 192
> 
> Move proc_remove() into the if_lock-protected list removal helper. Keep it
> before list_del_rcu() to preserve the ordering required by add_device().
> The rename path must then finish replacing the entry before removal, or
> it observes that the device is no longer on the list.
> 
> Fixes: 39df232f1a9b ("[PKTGEN]: fix device name handling")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>