[BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[Shuangpeng Bai]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in _raw_spin_lock_irqsave

on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)

To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds delays and print statements.

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/f7dab4725e2a2d57b1d302714c93c549

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

[   46.711115][    T9] ==================================================================
[   46.711848][    T9] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:1300 ./include/asm-generic/qspinlock.h:111 ./include/linux/spinlock.h:187 ./include/linux/spinlock_api_smp.h:133 kernel/locking/spinlock.c:166)
[   46.712620][    T9] Write of size 4 at addr ffff88811da9cb94 by task kworker/0:0/9
[   46.713329][    T9]
[   46.713560][    T9] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   46.713563][    T9] Workqueue: events nfc_llcp_tx_work
[   46.713570][    T9] Call Trace:
[   46.713573][    T9]  <TASK>
[   46.713574][    T9]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[   46.713580][    T9]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[   46.713598][    T9]  kasan_report (mm/kasan/report.c:595)
[   46.713606][    T9]  kasan_check_range (mm/kasan/generic.c:? mm/kasan/generic.c:200)
[   46.713609][    T9]  _raw_spin_lock_irqsave (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:1300 ./include/asm-generic/qspinlock.h:111 ./include/linux/spinlock.h:187 ./include/linux/spinlock_api_smp.h:133 kernel/locking/spinlock.c:166)
[   46.713621][    T9]  skb_queue_tail (net/core/skbuff.c:4114)
[   46.713627][    T9]  nfc_llcp_tx_work (net/nfc/llcp_core.c:848)
[   46.713631][    T9]  process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[   46.713637][    T9]  worker_thread (kernel/workqueue.c:3486)
[   46.713642][    T9]  kthread (kernel/kthread.c:436)
[   46.713654][    T9]  ret_from_fork (archkernel/process.c:158)
[   46.713669][    T9]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[   46.713673][    T9]  </TASK>
[   46.713675][    T9]
[   46.728016][    T9] Allocated by task 8236 on cpu 0 at 46.562534s:
[   46.728599][    T9]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[   46.729032][    T9]  __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
[   46.729460][    T9]  __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:5359)
[   46.729908][    T9]  sk_prot_alloc (./include/linux/slab.h:992 net/core/sock.c:2251)
[   46.730337][    T9]  sk_alloc (net/core/sock.c:2307)
[   46.730711][    T9]  llcp_sock_create (net/nfc/llcp_sock.c:1004 net/nfc/llcp_sock.c:1069)
[   46.731154][    T9]  nfc_sock_create (net/nfc/af_nfc.c:31)
[   46.731587][    T9]  __sock_create (net/socket.c:1651)
[   46.732010][    T9]  __sys_socket (net/socket.c:1709 net/socket.c:1746 net/socket.c:1793)
[   46.732424][    T9]  __x64_sys_socket (net/socket.c:1807 net/socket.c:1805 net/socket.c:1805)
[   46.732853][    T9]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   46.733274][    T9]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[   46.733815][    T9]
[   46.734038][    T9] Freed by task 8236 on cpu 0 at 46.686415s:
[   46.734594][    T9]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[   46.735024][    T9]  kasan_save_free_info (mm/kasan/generic.c:584)
[   46.735493][    T9]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[   46.735945][    T9]  kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)
[   46.736307][    T9]  __sk_destruct (net/core/sock.c:2290 net/core/sock.c:2390)
[   46.736732][    T9]  llcp_sock_release (.net/sock.h:2020 net/nfc/llcp_sock.c:664)
[   46.737189][    T9]  sock_close (net/socket.c:710 net/socket.c:1501)
[   46.737580][    T9]  __fput (fs/file_table.c:512)
[   46.737946][    T9]  fput_close_sync (fs/file_table.c:617)
[   46.738388][    T9]  __x64_sys_close (fs/open.c:1511 fs/open.c:1496 fs/open.c:1496)
[   46.738811][    T9]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   46.739230][    T9]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[   46.739771][    T9]
[   46.739991][    T9] The buggy address belongs to the object at ffff88811da9c800
[   46.739991][    T9]  which belongs to the cache kmalloc-1k of size 1024
[   46.741271][    T9] The buggy address is located 916 bytes inside of
[   46.741271][    T9]  freed 1024-byte region [ffff88811da9c800, ffff88811da9cc00)
[   46.742518][    T9]
[   46.742742][    T9] The buggy address belongs to the physical page:

Best,
Shuangpeng

Re: [BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[Eric Dumazet]

On Wed, Aug 19, 2026 at 7:00 AM Shuangpeng Bai
<shuangpeng.kernel@gmail.com> wrote:
>
> Hi Kernel Maintainers,
>
> I hit the following report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in _raw_spin_lock_irqsave
>
> on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)
>
> To help trigger the bug more reliably, we applied a minimal diagnostic patch
> that only adds delays and print statements.
>
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/f7dab4725e2a2d57b1d302714c93c549
>
> I'm happy to test debug patches or provide additional information.

Thanks for the report, could you test adding one skb_set_owner_w()
after the skb_copy() in nfc_llcp_tx_work() ?

Something like this (untested, not compiled) patch.

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index cac1b5487064d0c5b4966bb6a75aa26e67131049..49cb632268c0c2841e3b44dde124c7966267b709
100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -786,8 +786,11 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                        print_hex_dump_debug("LLCP Tx: ", DUMP_PREFIX_OFFSET,
                                             16, 1, skb->data, skb->len, true);

-                       if (ptype == LLCP_PDU_I)
+                       if (ptype == LLCP_PDU_I) {
                                copy_skb = skb_copy(skb, GFP_ATOMIC);
+                               if (copy_skb)
+                                       skb_set_owner_w(copy_skb, sk);
+                       }

                        __net_timestamp(skb);

Re: [BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[Shuangpeng]

> On Aug 19, 2026, at 03:48, Eric Dumazet <edumazet@google.com> wrote:
> 
> On Wed, Aug 19, 2026 at 7:00 AM Shuangpeng Bai
> <shuangpeng.kernel@gmail.com> wrote:
>> 
>> Hi Kernel Maintainers,
>> 
>> I hit the following report while testing current upstream kernel:
>> 
>> KASAN: slab-use-after-free in _raw_spin_lock_irqsave
>> 
>> on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)
>> 
>> To help trigger the bug more reliably, we applied a minimal diagnostic patch
>> that only adds delays and print statements.
>> 
>> The reproducer and .config files are here.
>> https://gist.github.com/shuangpengbai/f7dab4725e2a2d57b1d302714c93c549
>> 
>> I'm happy to test debug patches or provide additional information.
> 
> Thanks for the report, could you test adding one skb_set_owner_w()
> after the skb_copy() in nfc_llcp_tx_work() ?
> 
> Something like this (untested, not compiled) patch.

Thanks for your fix!

I tested the patch and reran the reproducer. The bug did not reappear.

> 
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index cac1b5487064d0c5b4966bb6a75aa26e67131049..49cb632268c0c2841e3b44dde124c7966267b709
> 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -786,8 +786,11 @@ static void nfc_llcp_tx_work(struct work_struct *work)
>                        print_hex_dump_debug("LLCP Tx: ", DUMP_PREFIX_OFFSET,
>                                             16, 1, skb->data, skb->len, true);
> 
> -                       if (ptype == LLCP_PDU_I)
> +                       if (ptype == LLCP_PDU_I) {
>                                copy_skb = skb_copy(skb, GFP_ATOMIC);
> +                               if (copy_skb)
> +                                       skb_set_owner_w(copy_skb, sk);
> +                       }
> 
>                        __net_timestamp(skb);