From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp153-162.sina.com.cn (smtp153-162.sina.com.cn [61.135.153.162]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 355FC344025 for ; Thu, 12 Mar 2026 02:26:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=61.135.153.162 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773282409; cv=none; b=DYuV8yLSW9I2rzyv2LZpl1yyQahguepfLH1s98hNe9G4w7WAYv7Ka0ovLdcWBYGj7hSZ5ZWOj89SOXLuWfNuZi5GBmldZR8c4BUPPNVf5M7EgvF0hLziCNQA7omnsMQrXVbjP9aVdeDTg+ag+62vqXNK9VwSiWuAAg32yld3dBc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773282409; c=relaxed/simple; bh=pIhu7I56BqxDafK6QAMtUqeWcT4fJF/iHOg0uFkaz4M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WYDer513ScR713xOQ+97GCqF+CiZDYQAiEThdwLQ72d4a/LrkqKL4Vgrc46R8h6KfFgf2odJNXBDFwSoBqVlDSfQ4cLF5S+J1s4jOeXEmBVSvx8COAu1eY/JonG9hhVJlzmyqFe3GIePOnf1m6BLIp0X8PckbFvKMsILk7HQSSw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=FUx1qv1X; arc=none smtp.client-ip=61.135.153.162 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="FUx1qv1X" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1773282402; bh=m+I/t48zr3/lLS2kNprPx27Kz+/jpjj0J0CleW7KuDA=; h=From:Subject:Date:Message-ID; b=FUx1qv1XSZvWfKL2c9owSDSBboZ7ru1EfeMygAVWgKdhTlr9Hnz4Rg6nTH4Rv30y/ ZAcTL7bHpyFQZtYw29gRvu9Mogy5HKJpsnaVtzXXqotP4/PwAtga1RZyH0z3Zx0XNO eNmqDFAP5ds+lrw0InZzxs58s0VeOvc8jC+DnH/M= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([114.249.62.144]) by sina.com (10.54.253.31) with ESMTP id 69B2245700000FB5; Thu, 12 Mar 2026 10:26:33 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 1443196816322 X-SMAIL-UIID: E1484190678D4E9CA1FB89F451BF0051-20260312-102633-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Date: Thu, 12 Mar 2026 10:26:23 +0800 Message-ID: <20260312022626.820-1-hdanton@sina.com> In-Reply-To: <69ad7ccb.a00a0220.b130.0003.GAE@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -471,12 +471,14 @@ static void lec_atm_close(struct atm_vcc struct sk_buff *skb; struct net_device *dev = (struct net_device *)vcc->proto_data; struct lec_priv *priv = netdev_priv(dev); + struct sock *sk = sk_atm(priv->lecd); priv->lecd = NULL; /* Do something needful? */ netif_stop_queue(dev); lec_arp_destroy(priv); + sock_put(sk); if (skb_peek(&sk_atm(vcc)->sk_receive_queue)) pr_info("%s closing with messages pending\n", dev->name); @@ -761,6 +763,7 @@ static int lecd_attach(struct atm_vcc *v priv->lecd = vcc; vcc->dev = &lecatm_dev; vcc_insert_socket(sk_atm(vcc)); + sock_hold(sk_atm(vcc)); vcc->proto_data = dev_lec[i]; set_bit(ATM_VF_META, &vcc->flags); --