Re: [PATCH v2] kobject: fix uevent socket use-after-free on net namespace delete

[Greg KH]

On Thu, Sep 17, 2026 at 10:38:26PM +0530, Adarsh Das wrote:
> When a network namespace is deleted, we free its uevent socket. But
> sometimes a device in that namespace is still being removed and tries to
> send a uevent through that socket. The socket is already freed, so KASAN
> reports a use-after-free.
> 
> This patch attempts the fix of taking a lock around both the send path
> and the free path, and clear the pointer before freeing so nobody uses
> it after free.
> 
> Reported-by: syzbot <syzbot+4393dfdddf166f2de2b0@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0
> Tested-by: syzbot <syzbot+4393dfdddf166f2de2b0@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Tested-by: Adarsh Das <adarshdas950@xxxxxxxxx>
> Assisted-by: Cursor AI
> Signed-off-by: Adarsh Das <adarshdas950@xxxxxxxxx>
> ---
>  lib/kobject_uevent.c | 24 +++++++++++++++++-------
>  1 file changed, 17 insertions(+), 7 deletions(-)
> 
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index ddbc4d7482d2..ecba33abb6b1 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -411,9 +411,15 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj,
>  						    devpath);
>  	else {
>  		const struct net *net = container_of(ns, struct net, ns);
> +		struct uevent_sock *ue_sk;
>  
> -		ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env,
> -						  action_string, devpath);
> +		mutex_lock(&uevent_sock_mutex);

Can't you use a guard to make this a lot cleaner?

thanks,

greg k-h