From: Hillf Danton <hdanton@sina.com>
To: syzbot <syzbot+f50072212ab792c86925@syzkaller.appspotmail.com>
Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
Date: Thu, 12 Mar 2026 10:26:23 +0800 [thread overview]
Message-ID: <20260312022626.820-1-hdanton@sina.com> (raw)
In-Reply-To: <69ad7ccb.a00a0220.b130.0003.GAE@google.com>
#syz test
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -471,12 +471,14 @@ static void lec_atm_close(struct atm_vcc
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ struct sock *sk = sk_atm(priv->lecd);
priv->lecd = NULL;
/* Do something needful? */
netif_stop_queue(dev);
lec_arp_destroy(priv);
+ sock_put(sk);
if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
pr_info("%s closing with messages pending\n", dev->name);
@@ -761,6 +763,7 @@ static int lecd_attach(struct atm_vcc *v
priv->lecd = vcc;
vcc->dev = &lecatm_dev;
vcc_insert_socket(sk_atm(vcc));
+ sock_hold(sk_atm(vcc));
vcc->proto_data = dev_lec[i];
set_bit(ATM_VF_META, &vcc->flags);
--
next prev parent reply other threads:[~2026-03-12 2:26 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-08 13:42 syzbot
2026-03-09 4:56 ` Forwarded: [PATCH] atm: lec: fix use-after-free in send_to_lecd syzbot
2026-03-09 5:24 ` Forwarded: " syzbot
2026-03-09 6:28 ` Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable() syzbot
2026-03-09 7:02 ` syzbot
2026-03-09 7:53 ` syzbot
2026-03-09 8:21 ` syzbot
2026-03-09 9:20 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Jiayuan Chen
2026-03-09 9:39 ` syzbot
2026-03-09 15:20 ` Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable() syzbot
2026-03-12 2:26 ` Hillf Danton [this message]
2026-03-12 2:46 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
2026-03-12 6:35 ` Hillf Danton
2026-03-12 6:53 ` syzbot
2026-03-12 7:37 ` Hillf Danton
2026-03-12 7:57 ` syzbot
2026-03-12 22:02 ` Hillf Danton
2026-03-12 22:22 ` syzbot
2026-03-13 18:44 ` Hillf Danton
2026-03-13 19:02 ` syzbot
[not found] <20260309045640.364653-1-kartikey406@gmail.com>
2026-03-09 5:15 ` syzbot
[not found] <CADhLXY4mSD+SP_A3a+z=Fx_hHoAfbW11MJmnMxwE+z7+G4Cc7Q@mail.gmail.com>
2026-03-09 5:43 ` syzbot
[not found] <20260309062812.435877-1-kartikey406@gmail.com>
2026-03-09 6:59 ` syzbot
[not found] <20260309070203.436407-1-kartikey406@gmail.com>
2026-03-09 7:36 ` syzbot
[not found] <20260309075327.437215-1-kartikey406@gmail.com>
2026-03-09 8:13 ` syzbot
[not found] <20260309082148.437826-1-kartikey406@gmail.com>
2026-03-09 8:44 ` syzbot
[not found] <20260309152037.506918-1-kartikey406@gmail.com>
2026-03-09 15:50 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260312022626.820-1-hdanton@sina.com \
--to=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+f50072212ab792c86925@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®