Re: [PATCH] net: mctp: hold a reference to the route device in mctp_route_lookup()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Wed, 12 Aug 2026 23:21:02 -0300 you wrote:
> mctp_route_lookup() uses rt->dev without holding a reference on it.
> mctp_route_lookup_single() returns the route under RCU only, so the
> route's device can be torn down concurrently: mctp_dev_put() drops the
> last reference and synchronously kfree()s mdev->addrs.  mctp_dev_saddr()
> then reads rt->dev->addrs[0], giving a use-after-free reachable by an
> unprivileged local AF_MCTP user on the receive/forwarding path (no
> CAP_NET_RAW required):
> 
> [...]

Here is the summary with links:
  - net: mctp: hold a reference to the route device in mctp_route_lookup()
    https://git.kernel.org/netdev/net/c/408da1df1811

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html