From befe96ed37d59b2940801e1682a0f410191da573 Mon Sep 17 00:00:00 2001 From: Henry Martin Date: Sat, 10 Oct 2026 16:49:58 +0800 Subject: [PATCH] ipconfig: fix use-after-free of device list after ic_close_devs() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ic_close_devs() kfree()s every ic_device node but leaves the static ic_first_dev and ic_dev pointers dangling behind. When a DHCP negotiation gets an OFFER but never the matching ACK, ic_bootp_recv() accepts the OFFER and records ic_dev = , the round times out and ic_close_devs() frees the whole list — node included. The next failed retry round runs ic_close_devs() once more, evaluating selected_dev = ic_dev ? ic_dev->dev : NULL; against the freed ic_device — an 8-byte use-after-free read. KASAN confirms: BUG: KASAN: slab-use-after-free in ic_close_devs+0x214/0x220 Read of size 8 ic_close_devs <- ip_auto_config Allocated by: ip_auto_config (ic_open_devs) Freed by: ic_close_devs <- ip_auto_config NULL both pointers after the free loop so retry rounds take the clean empty-list path. Cc: stable+noautosel@kernel.org # LLM report + LLM fix, not seen in real life Fixes: 46acf7bdbc72 ("Revert "net: ipv4: handle DSA enabled master network devices"") Signed-off-by: Henry Martin Reviewed-by: Simon Horman Link: https://patch.msgid.link/20261010085003.3261587-1-bsdhenrymartin@gmail.com Signed-off-by: Jakub Kicinski --- net/ipv4/ipconfig.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c index 1b8585404a41..d6db562636f3 100644 --- a/net/ipv4/ipconfig.c +++ b/net/ipv4/ipconfig.c @@ -346,6 +346,9 @@ static void __init ic_close_devs(void) kfree(d); } rtnl_unlock(); + + ic_first_dev = NULL; + ic_dev = NULL; } /*