From nobody Mon Jun 8 09:49:27 2026 Received: from mail-dy1-f177.google.com (mail-dy1-f177.google.com [74.125.82.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07386846A for ; Thu, 4 Jun 2026 00:09:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780531748; cv=none; b=JtApyFyQaBh+OjOf+PvyQo+VR2asHRFu1DBmmVMbtxVh6FKRLyExUGLiEKBHXFZC5Za2xRgI8E0xtg9FJmvJg7L8KxMeAhsMozEyx402QyCDISUKVKG+8YjBEqStRval7UU4fuFyZ4+jO1S4GrCFh/gEIZ60+BbOPh9ld+P2xpU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780531748; c=relaxed/simple; bh=84IYQMKG8viKCKRjmktbS7+OnIvgPuWpE6/gR4jV9OM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=oSGIGjURe4/PQuPUWjlOMAGXsRqrUwcGnB42q873KM3i6uSg5omx7Kf6uVAC1fsWKy1+LZ8Z17wjeA3tXBwy48Uyn7v4ltuIv9Sw2n8OKzpol6WBRSnqULGCT1/7t3VMVsASixVswO5mWsJSGM5LbUYI3et9KZ2ZA9NqWhaIHtY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sDgQZqx8; arc=none smtp.client-ip=74.125.82.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sDgQZqx8" Received: by mail-dy1-f177.google.com with SMTP id 5a478bee46e88-304cf518c9dso81360eec.1 for ; Wed, 03 Jun 2026 17:09:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780531746; x=1781136546; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=6h4FMlmT+v4RZFFdPUHJsy/yl90YP4Tu1Yv/uKfivvI=; b=sDgQZqx8sSzr+fNBCIZ0O5NYirzVn5utT7f4bnPWZzEqrV6CGnDn10VSg5QEAUMBrB aX4AeuDa8pcngStwfcelXS/HzbsnCYh9jFEs/xj+XsNuF+gwtvv3CzMlFZK+FpRr0QXM gVd7MEoOGDN4hYfQA1LbZ/tP6ssRd1RLnwLyp7ioFpuc8YlzmsoZCF9LdJDUTp/Ew1Ka IDF3IdHNsGnfAp/9Clprv3nZUOr5R65PlyNRX6YZJ7rw9a41oZS35JHrdYB0fOfH7TLt orevdyEvkF2WD+9kV7WBIX922mPf75zUHokE8ARkAMHnHK7iKeK/En8JRkySSjQzb90O fpmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780531746; x=1781136546; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=6h4FMlmT+v4RZFFdPUHJsy/yl90YP4Tu1Yv/uKfivvI=; b=bEkkKjd6u4LLM3JRD7hoA6cM6MHJNkyJM7nSM652KSmVHpQNBlkT64JuWiPmeyGZZv fgpSNSHDhmqs9R76l/wx+SEWeU7ANdKcwazxHN6ZpA0mrNkRmJKTRWy+ebGzU8ArVBow M8vaK10Xe/RcPHuXP/d145TZ20aV4nVgEfXy2bhgi+45oNJxO5sOcvCGx9w9stD2W3qe EUHA8yj3fyw8j/y3fk4GJ8ljZwZseo/ib9jC0/7iHPwXme1gYjUKWhB2bQL0uP8BWTac s6Qni8EIx1Skgi4MxUG+ydcMtHO8WmKczs/zGOgVTlEy155Jt+m1N4OIaIQecerZlzxu eofw== X-Forwarded-Encrypted: i=1; AFNElJ9j0WIHClrVbN1EOawaWvca9VHB66s/jtCsxSk7AIOirRZWElZO85KdEk9cOHRP5Tv9GAfW86OCoUDWFOM=@vger.kernel.org X-Gm-Message-State: AOJu0YzMcrZrUGskif84N2ZE803oVhshlNRom+3EL4asYj/msMAME/6C 7P21mU3A0OB4U0qNZqqqQ/Zuma/Azlj2gC+bHn2tnBAvg12mFTTSy6Yq X-Gm-Gg: Acq92OFD5xSKZcU0KwmG2i1DlsNDmjqggQkLlgIUOr9A3jQQyVSWbWSJKvKHq5pAI8s BuyEreWV6MnIHrVq614Znj1MHOxvUU6aDKa4JYnIjvoHpI7zY23WaCBcMHsmNPepwF9+148JNMQ Yn2xCvXQwh8ErZmE+qZ9K9EUkargghgoY6eCmyZGcWGnlH7o6qSJl90GooLda0ba4Ujk98L5kA7 xc5OYfkCG1xlR1zLE6wLpYdPWeS0H3EFf4apy/sHifvl3ZX0r/H+bHixHPmhZYaFqTqPBMBZa/C ooz/016blrrQgIZk3jOtQU4daafmx0vC4+1Ye14WcX9Kcf5Gk3vNGGCvMWFci9afPts7RkZhDF8 QtJqk25FCpaWOsPQvGKV0V2iP5Uj5H3tsV5GtbzucCgjtUoKlV+AKEvG/g4xpSwdWr2nL1YU6rn TE59Ym11hDaZ39Zg9l3KljGI3XIhwsrAyFd84/4A== X-Received: by 2002:a05:693c:25c5:b0:2ed:e14:7f5c with SMTP id 5a478bee46e88-3074fc2c6fcmr3041864eec.32.1780531746082; Wed, 03 Jun 2026 17:09:06 -0700 (PDT) Received: from ubuntu.. ([149.88.30.81]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3074df48671sm3534373eec.24.2026.06.03.17.09.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 Jun 2026 17:09:04 -0700 (PDT) From: Santosh Kalluri To: netdev@vger.kernel.org Cc: Remi Denis-Courmont , =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , linux-kernel@vger.kernel.org Subject: [PATCH net] net: phonet: free phonet_device after RCU grace period Date: Wed, 3 Jun 2026 17:08:43 -0700 Message-ID: <20260604000843.4028467-1-santosh.kalluri129@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(), matching the lifetime rule already used by phonet_address_del() for the same object type. Fixes: eeb74a9d45f7 ("Phonet: convert devices list to RCU") Cc: stable@vger.kernel.org Signed-off-by: Santosh Kalluri Acked-by: R=C3=A9mi Denis-Courmont --- net/phonet/pn_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c index 86325b7fc1b6..ad44831d6745 100644 --- a/net/phonet/pn_dev.c +++ b/net/phonet/pn_dev.c @@ -108,7 +108,7 @@ static void phonet_device_destroy(struct net_device *de= v) for_each_set_bit(addr, pnd->addrs, 64) phonet_address_notify(net, RTM_DELADDR, ifindex, addr); =20 - kfree(pnd); + kfree_rcu(pnd, rcu); } } =20 base-commit: f723ccaff2fb72b71ae8a9fd283f0dee4d9ae7a3 --=20 2.43.0