Re: [PATCH net] slip: fix use-after-free in sl_sync()
From: Jakub Kicinski
Date: Thu Aug 20 2026 - 16:59:36 EST
On Mon, 17 Aug 2026 10:09:52 +0300 Aleksandr Khromov wrote:
> slip_devs[] stores bare net_device pointers and takes no reference on
> them. sl_sync() and sl_alloc() walk that table from slip_open() under
> rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
> sl_setup() installs as dev->priv_destructor.
Would it not be a much simpler fix to move the deinit to ndo_uninit
if we need rtnl_lock?
--
pw-bot: cr