[PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[Adarsh Das]

When a network namespace is deleted, we free its uevent socket. But
sometimes a device in that namespace is still being removed and tries to
send a uevent through that socket. The socket is already freed, so KASAN
reports a use-after-free.

This patch attempts the fix of taking a lock around both the send path
and the free path, and clear the pointer before freeing so nobody uses
it after free.

Reported-by: syzbot <syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0
Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
---
 lib/kobject_uevent.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..ecba33abb6b1 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -411,9 +411,15 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj,
 						    devpath);
 	else {
 		const struct net *net = container_of(ns, struct net, ns);
+		struct uevent_sock *ue_sk;
 
-		ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env,
-						  action_string, devpath);
+		mutex_lock(&uevent_sock_mutex);
+		ue_sk = net->uevent_sock;
+		if (ue_sk && ue_sk->sk)
+			ret = uevent_net_broadcast_tagged(ue_sk->sk, env,
+							  action_string,
+							  devpath);
+		mutex_unlock(&uevent_sock_mutex);
 	}
 #endif
 
@@ -804,13 +810,17 @@ static int uevent_net_init(struct net *net)
 
 static void uevent_net_exit(struct net *net)
 {
-	struct uevent_sock *ue_sk = net->uevent_sock;
+	struct uevent_sock *ue_sk;
 
-	if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) {
-		mutex_lock(&uevent_sock_mutex);
+	mutex_lock(&uevent_sock_mutex);
+	ue_sk = net->uevent_sock;
+	net->uevent_sock = NULL;
+	if (ue_sk && sock_net(ue_sk->sk)->user_ns == &init_user_ns)
 		list_del(&ue_sk->list);
-		mutex_unlock(&uevent_sock_mutex);
-	}
+	mutex_unlock(&uevent_sock_mutex);
+
+	if (!ue_sk)
+		return;
 
 	netlink_kernel_release(ue_sk->sk);
 	kfree(ue_sk);
-- 
2.55.0

Re: [PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[Greg KH]

On Thu, Sep 17, 2026 at 08:12:06PM +0530, Adarsh Das wrote:
> When a network namespace is deleted, we free its uevent socket. But
> sometimes a device in that namespace is still being removed and tries to
> send a uevent through that socket. The socket is already freed, so KASAN
> reports a use-after-free.
> 
> This patch attempts the fix of taking a lock around both the send path
> and the free path, and clear the pointer before freeing so nobody uses
> it after free.
> 
> Reported-by: syzbot <syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com>
> Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0
> Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
> ---
>  lib/kobject_uevent.c | 24 +++++++++++++++++-------
>  1 file changed, 17 insertions(+), 7 deletions(-)

Did you forget an Assisted-by: tag?

How was this tested?

thanks,

greg k-h

Re: [PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[Adarsh Das]

Hi,

Sorry, I wasn't aware of the Assisted-by tag before. Should I send a
V2 with it?

For testing I ran syzbot's C repro with -smp 4 on master, with
multiple parallel instances of the repro. I was able to reproduce
the bug:

  BUG: KASAN: slab-use-after-free in kobject_uevent_env+
  Read of size 8 at addr ffff88800fa7f090 by task kworker/u16:5
  CPU: 3
  Workqueue: ib-unreg-wq ib_unregister_work
  Call Trace:
    kasan_report
    kobject_uevent_env+0xc71/0xd90
    device_del+0x7c7/0xcf0
    disable_device+0x1d2/0x260
    __ib_unregister_device+0x26b/0x400
    ib_unregister_work+0x19/0x30
    worker_thread
    kthread
  Allocated by task 498:
    uevent_net_init+0xe5/0x340
    setup_net
    copy_net_ns
    unshare_nsproxy_namespaces
    ksys_unshare
  Freed by task 63:
    kfree
    ops_undo_list
    cleanup_net
    worker_thread
  The buggy address belongs to the cache kmalloc-32 of size 32

With this patch applied, I ran the same repro repeatedly (including
parallel runs) and did not see the KASAN error anymore.

Re: [PATCH] kobject: fix uevent socket use-after-free on net namespace delete

[Greg KH]

A: http://en.wikipedia.org/wiki/Top_post
Q: Were do I find info about this thing called top-posting?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?

A: No.
Q: Should I include quotations after my reply?

http://daringfireball.net/2007/07/on_top

On Thu, Sep 17, 2026 at 08:48:30PM +0530, Adarsh Das wrote:
> Hi,
> 
> Sorry, I wasn't aware of the Assisted-by tag before. Should I send a
> V2 with it?

Please do.

> For testing I ran syzbot's C repro with -smp 4 on master, with
> multiple parallel instances of the repro. I was able to reproduce
> the bug:
> 
>   BUG: KASAN: slab-use-after-free in kobject_uevent_env+
>   Read of size 8 at addr ffff88800fa7f090 by task kworker/u16:5
>   CPU: 3
>   Workqueue: ib-unreg-wq ib_unregister_work
>   Call Trace:
>     kasan_report
>     kobject_uevent_env+0xc71/0xd90
>     device_del+0x7c7/0xcf0
>     disable_device+0x1d2/0x260
>     __ib_unregister_device+0x26b/0x400
>     ib_unregister_work+0x19/0x30
>     worker_thread
>     kthread
>   Allocated by task 498:
>     uevent_net_init+0xe5/0x340
>     setup_net
>     copy_net_ns
>     unshare_nsproxy_namespaces
>     ksys_unshare
>   Freed by task 63:
>     kfree
>     ops_undo_list
>     cleanup_net
>     worker_thread
>   The buggy address belongs to the cache kmalloc-32 of size 32
> 
> With this patch applied, I ran the same repro repeatedly (including
> parallel runs) and did not see the KASAN error anymore.

Did syzbot also test this?

And I have no context here at all, sorry, please realize that some of us
get 1000+ emails a day...

thanks,

greg k-h

[PATCH v2] kobject: fix uevent socket use-after-free on net namespace delete

[Adarsh Das]

Hi Greg,

v2 adds Assisted-by and Tested-by tags as requested.

Local testing: syzbot C repro on unfixed master with -smp 4 (parallel
runs) reproduced the KASAN UAF. With patch applied, no KASAN.

Syzbot testing: #syz test with patch on upstream — Result OK
https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0

Adarsh

[PATCH v2] kobject: fix uevent socket use-after-free on net namespace delete

[Adarsh Das]

When a network namespace is deleted, we free its uevent socket. But
sometimes a device in that namespace is still being removed and tries to
send a uevent through that socket. The socket is already freed, so KASAN
reports a use-after-free.

This patch attempts the fix of taking a lock around both the send path
and the free path, and clear the pointer before freeing so nobody uses
it after free.

Reported-by: syzbot <syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com>
Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0
Tested-by: syzbot <syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com>
Tested-by: Adarsh Das <adarshdas950@gmail.com>
Assisted-by: Cursor AI
Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
---
 lib/kobject_uevent.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..ecba33abb6b1 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -411,9 +411,15 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj,
 						    devpath);
 	else {
 		const struct net *net = container_of(ns, struct net, ns);
+		struct uevent_sock *ue_sk;
 
-		ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env,
-						  action_string, devpath);
+		mutex_lock(&uevent_sock_mutex);
+		ue_sk = net->uevent_sock;
+		if (ue_sk && ue_sk->sk)
+			ret = uevent_net_broadcast_tagged(ue_sk->sk, env,
+							  action_string,
+							  devpath);
+		mutex_unlock(&uevent_sock_mutex);
 	}
 #endif
 
@@ -804,13 +810,17 @@ static int uevent_net_init(struct net *net)
 
 static void uevent_net_exit(struct net *net)
 {
-	struct uevent_sock *ue_sk = net->uevent_sock;
+	struct uevent_sock *ue_sk;
 
-	if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) {
-		mutex_lock(&uevent_sock_mutex);
+	mutex_lock(&uevent_sock_mutex);
+	ue_sk = net->uevent_sock;
+	net->uevent_sock = NULL;
+	if (ue_sk && sock_net(ue_sk->sk)->user_ns == &init_user_ns)
 		list_del(&ue_sk->list);
-		mutex_unlock(&uevent_sock_mutex);
-	}
+	mutex_unlock(&uevent_sock_mutex);
+
+	if (!ue_sk)
+		return;
 
 	netlink_kernel_release(ue_sk->sk);
 	kfree(ue_sk);
-- 
2.55.0

Re: [PATCH v2] kobject: fix uevent socket use-after-free on net namespace delete

[Greg KH]

On Thu, Sep 17, 2026 at 10:38:26PM +0530, Adarsh Das wrote:
> When a network namespace is deleted, we free its uevent socket. But
> sometimes a device in that namespace is still being removed and tries to
> send a uevent through that socket. The socket is already freed, so KASAN
> reports a use-after-free.
> 
> This patch attempts the fix of taking a lock around both the send path
> and the free path, and clear the pointer before freeing so nobody uses
> it after free.
> 
> Reported-by: syzbot <syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com>
> Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0
> Tested-by: syzbot <syzbot+4393dfdddf166f2de2b0@syzkaller.appspotmail.com>
> Tested-by: Adarsh Das <adarshdas950@gmail.com>
> Assisted-by: Cursor AI
> Signed-off-by: Adarsh Das <adarshdas950@gmail.com>
> ---
>  lib/kobject_uevent.c | 24 +++++++++++++++++-------
>  1 file changed, 17 insertions(+), 7 deletions(-)
> 
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index ddbc4d7482d2..ecba33abb6b1 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -411,9 +411,15 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj,
>  						    devpath);
>  	else {
>  		const struct net *net = container_of(ns, struct net, ns);
> +		struct uevent_sock *ue_sk;
>  
> -		ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env,
> -						  action_string, devpath);
> +		mutex_lock(&uevent_sock_mutex);

Can't you use a guard to make this a lot cleaner?

thanks,

greg k-h