Re: [PATCH net] net/dibs: Correct freeing of dmb_clientid_arr

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Mon, 10 Aug 2026 13:14:32 +0200 you wrote:
> A dibs device interrupt handler can be active after dibs_dev_del() and
> may still access dmb_clientid_arr. (UAF)
> 
> In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe()
> dmb_clientid_arr is freed twice (double free).
> 
> Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.
> Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok
> for now, because no dmbs can be registered before dibs_dev_add().
> 
> [...]

Here is the summary with links:
  - [net] net/dibs: Correct freeing of dmb_clientid_arr
    https://git.kernel.org/netdev/net/c/9e6869be4906

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html