From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0BBC4C6C for ; Sat, 17 Jan 2026 11:32:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768649558; cv=none; b=M2Fo0idtqC4aCNg+/F2nnI1EWRzXADzFG4WO4u2LGljKzTAQYXLIMVR+mJ1HP9g+1T2GjAj8vhIUoeg+0vxP4I4or9bkF1NgK/fzRaehffBzdmUJUJwYomqBGoQG4/TDV8edm7EZXkB688RM5K15gUV7fTy5mHlusFw/o/eJRjw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768649558; c=relaxed/simple; bh=HcNGBkISYCNCokjHo/tfJuYBonXnouJH+scDyoA/ksA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=hBqSqYJU8SNhkC6eb3VmzIFOka8+/5AgL8VKpu/sk5S1lkUzpiOlTEgI/Riy2GSeUNN+kSBlCO0VLFm+uvC1JDhe1C+EadUs2VpmfCOIj/PKz8qRMwrfmDVsnEl1o4PaaBD68x+/lBcVjefckVFDyMHdLTfbBCStyqKnzMTcxrI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RRrJoFIF; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RRrJoFIF" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2a0ac29fca1so18248785ad.2 for ; Sat, 17 Jan 2026 03:32:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768649556; x=1769254356; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=noh4RnSugDMyu0ry6DZexFBAZVaKuGAvqpHPXwgeozE=; b=RRrJoFIFpoMP/knOW+SiWOC+XIZ/NE3UQA8hwGVQP/7D5sjT634Y+x6bZYtsQaNW5B 987lzhYUpB5jKb5K86YAqpahSderdrzdkeI3E0z74i4SQBIjl8caPM50EsG6QRhRtYW9 RKhKdLlNxRUQlI1Bj0mc+cNE4AWHDEAaT3OmRqW/Ez3RtRjmhAUDk/ulRCU2BwyNvp5C u42GQcVduh5mY7iJ+fblOIKpmHrv5u01U3iQOq13H952yiXlEIWFarh4v9V4ANN0I65Q xXXnW6m2E7AMT3IMiWEnnS36QP76YEL1luAfcsHtG60e59YIInFmQwX1qKZ9tgMx+XTm Lfzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768649556; x=1769254356; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=noh4RnSugDMyu0ry6DZexFBAZVaKuGAvqpHPXwgeozE=; b=jlavPEa6QIQOYVuNVydwGTobnEKyuC/BHG4zKmNAbCUEgiuVaae13NdFuL3fCICefL yAOjTRnMi48vPOlWcQnngztOevd8+DF27thzgcaT9ZQw3vY6gHA97sqyaEq+JdKt58Nb zBUZXDVGIzcA6RsHNTcl7q3aUzD22CEUsfx8wD/vAMKKvteku6x3j0Ycw2FReSHuYR/m EUgQuB7oZe6TQkTZrEVpkVwUjX9GvgZdqz88ksd9YXzVc5n6W/jn0OO+vgQ5guQbcQmQ IWzdgCFu+Xxt/2fBMM6xLh7mYWocX4ZSTpuFHh1gPNUL53VDBSQaLVOmdW/qBrfCrvCN ZoJA== X-Forwarded-Encrypted: i=1; AJvYcCWIIwcB5zoNbIxSuSgpF+lFuOOn3mLbR7+qDnTqhrq+4NqzTkSYQVghbXqXN4Xzm6H2Qa3WYON8/aLzxwc=@vger.kernel.org X-Gm-Message-State: AOJu0YzEnl9YyttLJcB9VTlSrT0p2nflcFbAiOkzRIPDV5lwj2EChAAv OEgpeZ2r1nw9yjRKD3YgGDJkFKk+yYewp7c5HV52IlKExiUE6fx+x98Dey4qS6ZQ X-Gm-Gg: AY/fxX6ZSePXiPlQtLpw99KMd5K9Fy8nJPUcO4oyBBQSBab82IaW/aeKJgMG/Qvgmqq ENhM0CxJfh51sFH1NPAKnrN4m/Game3i8/h/O0hc3712R2tuYF/V//R6EXibB+AWQ7of2pCKbbZ SxQIRs+nHJf836Fb9tsPP9znBbN9Yq1fjTAGS6U0VGkG1/pgVCEaMvZhnxAQRTPM81VdYIkbAeR erMwJ9CgFzoyEV/tKM9gz23xir3KrBgU3hUHb9HWNbcM7iswI505shw0kMy8mA8eXwwnROdYXAd O9RfVgmFxQfQsSBvzHxzWLLhd8KQ4Ci5KDIOA9TnoJQdG7Q191Dr8f3cLsmJ5LM/8TPzsMupNHo apvsmV+yozXTWb79FKh+UM8o+56RmduSSuklUzI2avxbnyHrU77qm32v2dUkH5wBO5Da6ljTO1z zXQEIr49ZJa77gwQm6nKfSmLyYiV7v3L0d168ANA== X-Received: by 2002:a17:903:3c45:b0:29d:975a:2123 with SMTP id d9443c01a7336-2a7177d85eemr51647085ad.60.1768649556109; Sat, 17 Jan 2026 03:32:36 -0800 (PST) Received: from name2965-Precision-7820-Tower.. ([121.185.186.233]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a71940659fsm44062315ad.83.2026.01.17.03.32.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Jan 2026 03:32:35 -0800 (PST) From: Jeongjun Park To: syzbot+999115c3bf275797dc27@syzkaller.appspotmail.com Cc: syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org Subject: Re: [syzbot] [hams?] BUG: unable to handle kernel paging request in sk_skb_reason_drop Date: Sat, 17 Jan 2026 20:32:31 +0900 Message-Id: <20260117113231.179542-1-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <69694d6f.050a0220.58bed.0029.GAE@google.com> References: <69694d6f.050a0220.58bed.0029.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test upstream master --- net/netrom/nr_route.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index b94cb2ffbaf8..88e9328e594a 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -752,7 +752,7 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) unsigned char *dptr; ax25_cb *ax25s; int ret; - struct sk_buff *skbn; + struct sk_buff *nskb, *oskb; /* * Reject malformed packets early. Check that it contains at least 2 @@ -811,14 +811,14 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) /* We are going to change the netrom headers so we should get our own skb, we also did not know until now how much header space we had to reserve... - RXQ */ - if ((skbn=skb_copy_expand(skb, dev->hard_header_len, 0, GFP_ATOMIC)) == NULL) { + if ((nskb = skb_copy_expand(skb, dev->hard_header_len, 0, GFP_ATOMIC)) == NULL) { nr_node_unlock(nr_node); nr_node_put(nr_node); dev_put(dev); return 0; } - kfree_skb(skb); - skb=skbn; + oskb = skb; + skb = nskb; skb->data[14]--; dptr = skb_push(skb, 1); @@ -837,6 +837,8 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25) nr_node_unlock(nr_node); nr_node_put(nr_node); + if (ret) + kfree_skb(oskb); return ret; } --