Re: [PATCH net] net/dibs: Fix UAF of dmb_clientid_arr after dibs_dev_del()

[Jakub Kicinski]

On Fri, 7 Aug 2026 16:07:53 +0200 Alexandra Winter wrote:
> > [Severity: High]
> > These are the two failure returns that reach the loopback err_reg path
> > described above: device_add() returning an error (-ENOMEM, or a
> > kobject_add()/duplicate-name failure) and sysfs_create_group() returning
> > -ENOMEM.  In both cases dmb_clientid_arr is still allocated and not NULLed,
> > so the caller-side kfree() and dibs_dev_release() both free it.  The
> > kzalloc-failure case is fine because the pointer is still NULL.
> 
> Same as above (?)
> 
> [PATCH net v2] dibs: fix double free of dmb_clientid_arr
> is in discussion on the netdev mailinglist already.

Please don't expect me to fish out such codependent patches
magically without so much as a note in the commit msg.
You have to repost this, and please do a better job of grouping 
the fixes going forward :/ This is a waste of time for both of us.