AZL-96156

In the Linux kernel, the following vulnerability has been resolved:

net: pktgen: fix proc entry use-after-free

pktgenchangename() replaces pktdev->entry while holding t->iflock. pktgenremovedevice() removes the same entry before remdevfromif_list() takes that lock.

This allows the following interleaving:

CPU 0 (NETDEVCHANGENAME) CPU 1 (kpktgend) iflock(t) procremove(pktdev->entry) procremove(pktdev->entry) pktdev->entry = proccreatedata(...) ifunlock(t)

The kthread can pass the stale procdirentry to proc_remove() after the rename path has freed it. A reproducer with a widened race window reports:

BUG: KASAN: slab-use-after-free in procremove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend0/67 Call Trace: procremove+0x78/0x80 pktgenremovedevice.isra.0+0x11c/0x4c0 pktgenthread_worker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: __proccreate+0x204/0x790 proccreatedata+0x72/0xe0 pktgenthreadwrite+0xd61/0x1510 Freed by task 28: kmemcachefree+0xcb/0x3d0 procfreeinode+0x5b/0x80 rcucore+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache procdirentry of size 192

Move procremove() into the iflock-protected list removal helper. Keep it before listdelrcu() to preserve the ordering required by add_device(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list.