[BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[Shuangpeng Bai <shuangpeng.kernel@gmail.com>]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in _raw_spin_lock_irqsave

on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)

To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds delays and print statements.

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/f7dab4725e2a2d57b1d302714c93c549

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

[   46.711115][    T9] ==================================================================
[   46.711848][    T9] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:1300 ./include/asm-generic/qspinlock.h:111 ./include/linux/spinlock.h:187 ./include/linux/spinlock_api_smp.h:133 kernel/locking/spinlock.c:166)
[   46.712620][    T9] Write of size 4 at addr ffff88811da9cb94 by task kworker/0:0/9
[   46.713329][    T9]
[   46.713560][    T9] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   46.713563][    T9] Workqueue: events nfc_llcp_tx_work
[   46.713570][    T9] Call Trace:
[   46.713573][    T9]  <TASK>
[   46.713574][    T9]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[   46.713580][    T9]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[   46.713598][    T9]  kasan_report (mm/kasan/report.c:595)
[   46.713606][    T9]  kasan_check_range (mm/kasan/generic.c:? mm/kasan/generic.c:200)
[   46.713609][    T9]  _raw_spin_lock_irqsave (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:1300 ./include/asm-generic/qspinlock.h:111 ./include/linux/spinlock.h:187 ./include/linux/spinlock_api_smp.h:133 kernel/locking/spinlock.c:166)
[   46.713621][    T9]  skb_queue_tail (net/core/skbuff.c:4114)
[   46.713627][    T9]  nfc_llcp_tx_work (net/nfc/llcp_core.c:848)
[   46.713631][    T9]  process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[   46.713637][    T9]  worker_thread (kernel/workqueue.c:3486)
[   46.713642][    T9]  kthread (kernel/kthread.c:436)
[   46.713654][    T9]  ret_from_fork (archkernel/process.c:158)
[   46.713669][    T9]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[   46.713673][    T9]  </TASK>
[   46.713675][    T9]
[   46.728016][    T9] Allocated by task 8236 on cpu 0 at 46.562534s:
[   46.728599][    T9]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[   46.729032][    T9]  __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
[   46.729460][    T9]  __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:5359)
[   46.729908][    T9]  sk_prot_alloc (./include/linux/slab.h:992 net/core/sock.c:2251)
[   46.730337][    T9]  sk_alloc (net/core/sock.c:2307)
[   46.730711][    T9]  llcp_sock_create (net/nfc/llcp_sock.c:1004 net/nfc/llcp_sock.c:1069)
[   46.731154][    T9]  nfc_sock_create (net/nfc/af_nfc.c:31)
[   46.731587][    T9]  __sock_create (net/socket.c:1651)
[   46.732010][    T9]  __sys_socket (net/socket.c:1709 net/socket.c:1746 net/socket.c:1793)
[   46.732424][    T9]  __x64_sys_socket (net/socket.c:1807 net/socket.c:1805 net/socket.c:1805)
[   46.732853][    T9]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   46.733274][    T9]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[   46.733815][    T9]
[   46.734038][    T9] Freed by task 8236 on cpu 0 at 46.686415s:
[   46.734594][    T9]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[   46.735024][    T9]  kasan_save_free_info (mm/kasan/generic.c:584)
[   46.735493][    T9]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[   46.735945][    T9]  kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)
[   46.736307][    T9]  __sk_destruct (net/core/sock.c:2290 net/core/sock.c:2390)
[   46.736732][    T9]  llcp_sock_release (.net/sock.h:2020 net/nfc/llcp_sock.c:664)
[   46.737189][    T9]  sock_close (net/socket.c:710 net/socket.c:1501)
[   46.737580][    T9]  __fput (fs/file_table.c:512)
[   46.737946][    T9]  fput_close_sync (fs/file_table.c:617)
[   46.738388][    T9]  __x64_sys_close (fs/open.c:1511 fs/open.c:1496 fs/open.c:1496)
[   46.738811][    T9]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   46.739230][    T9]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[   46.739771][    T9]
[   46.739991][    T9] The buggy address belongs to the object at ffff88811da9c800
[   46.739991][    T9]  which belongs to the cache kmalloc-1k of size 1024
[   46.741271][    T9] The buggy address is located 916 bytes inside of
[   46.741271][    T9]  freed 1024-byte region [ffff88811da9c800, ffff88811da9cc00)
[   46.742518][    T9]
[   46.742742][    T9] The buggy address belongs to the physical page:

Best,
Shuangpeng