struct nf_hook_ops has a pointer to dev, which can be used by __nf_unregister_net_hook() after it has been freed by tun_chr_close(). Fix it by calling dev_hold() when saving dev to ops struct. Reported-by: syzbot+bb9127e278fa198e110c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bb9127e278fa198e110c Signed-off-by: Helen Koike --- net/netfilter/nf_tables_api.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index fd7f7e4e2a43..00b5f900a51d 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -352,6 +352,7 @@ static void nft_netdev_hook_free_ops(struct nft_hook *hook) list_for_each_entry_safe(ops, next, &hook->ops_list, list) { list_del(&ops->list); + dev_put(ops->dev); kfree(ops); } } @@ -2374,6 +2375,7 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net, err = -ENOMEM; goto err_hook_free; } + dev_hold(dev); ops->dev = dev; list_add_tail(&ops->list, &hook->ops_list); } -- 2.53.0