Re: [syzbot] [net?] KASAN: slab-use-after-free Read in tcp_prune_ofo_queue

[Hillf Danton <hdanton@sina.com>]

> Date: Tue, 15 Jul 2025 14:46:36 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    55e8757c6962 Merge branch 'net-mctp-improved-bind-handling'
> git tree:       net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=15834382580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f8235fb7e74dd7f6
> dashboard link: https://syzkaller.appspot.com/bug?extid=9d2a6ef56c3805144bf0
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1445058c580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=148e098c580000

#syz test

--- x/net/ipv4/tcp_input.c
+++ y/net/ipv4/tcp_input.c
@@ -5514,14 +5514,16 @@ static bool tcp_prune_ofo_queue(struct s
 		prev = rb_prev(node);
 		rb_erase(node, &tp->out_of_order_queue);
 		goal -= skb->truesize;
-		tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);
 		tp->ooo_last_skb = rb_to_skb(prev);
 		if (!prev || goal <= 0) {
 			if (tcp_can_ingest(sk, skb) &&
-			    !tcp_under_memory_pressure(sk))
+			    !tcp_under_memory_pressure(sk)) {
+				tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);
 				break;
+			}
 			goal = sk->sk_rcvbuf >> 3;
 		}
+		tcp_drop_reason(sk, skb, SKB_DROP_REASON_TCP_OFO_QUEUE_PRUNE);
 		node = prev;
 	} while (node);
 
--