[rds-devel] [External] : Re: [linus:master] [sysctl] 8d75c338f0: BUG:KASAN:slab-use-after-free_in_touch_wq_lockdep_map

[Joel Granados]

On Tue, Oct 20, 2026 at 01:05:01PM +0200, Oleg Nesterov wrote:
> On 10/20, Joel Granados wrote:
> >
> > On Mon, Oct 19, 2026 at 12:52:58PM -0700, Allison Henderson wrote:
> > >
> > > CONFIG_SYSCTL=n.  A simpler fix might be to just handle the NULL at the
> > > three call sites, e.g.:
> > >
> > >         rds_sysctl_reg_table =
> > >                 register_net_sysctl(&init_net, "net/rds", rds_sysctl_rds_table);
> > >         if (!rds_sysctl_reg_table && IS_ENABLED(CONFIG_SYSCTL))
> > >                 return -ENOMEM;
> > >
> >
> > Remember to NULL check rds_sysctl_reg_table in rds_sysctl_exit(). You
> > might hit another UAF on exit if you don't.
> 
> Why? unregister_sysctl_table(header) does nothing if header == NULL.
Nice catch! You can forgo the check as it is the first thing that
happens in unregister_sysctl_table.

Best
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <http://oss.oracle.com/pipermail/rds-devel/attachments/20261021/f8f22350/attachment.sig>