[BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb

[Shuangpeng Bai <shuangpeng.kernel@gmail.com>]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in nfc_llcp_rx_skb

on commit: 3609fa95fb0f2c1b099e69e56634edb8fc03f87c (2026-01-04)

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/70e3bdc241dbd675970fe89f30f0b84e

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

Decoded source path:

use: net/nfc/llcp_core.c:1185 in nfc_llcp_recv_disc(), reading sk->sk_state
     after nfc_llcp_sock_put() at line 1182; DISC dispatch is called from
     net/nfc/llcp_core.c:1483 in nfc_llcp_rx_skb().
free: concurrent socket release drops the final reference through
      net/nfc/llcp_sock.c:646 sock_put(), then sk_free() releases the same
      struct nfc_llcp_sock allocation.

[   81.172360][  T830] BUG: KASAN: slab-use-after-free in nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
[   81.173044][  T830] Read of size 1 at addr ffff888119369812 by task kworker/1:2/830
[   81.173940][  T830] Tainted: [B]=BAD_PAGE, [W]=WARN
[   81.173941][  T830] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   81.173943][  T830] Workqueue: events nfc_llcp_rx_work
[   81.173946][  T830] Call Trace:
[   81.173947][  T830]  <TASK>
[   81.173952][  T830]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[   81.173959][  T830]  kasan_report (mm/kasan/report.c:597)
[   81.173965][  T830]  nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
[   81.173973][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
[   81.173976][  T830]  process_scheduled_works (kernel/workqueue.c:3262 kernel/workqueue.c:3340)
[   81.173980][  T830]  worker_thread (./include/linux/list.h:381 kernel/workqueue.c:946 kernel/workqueue.c:3422)
[   81.173984][  T830]  kthread (kernel/kthread.c:465)
[   81.174000][  T830]  ret_from_fork (archkernel/process.c:164)
[   81.174011][  T830]  ret_from_fork_asm (arch/x86/entry/entry_64.S:256)
[   81.174014][  T830]  </TASK>
[   81.187221][  T830] Allocated by task 4409 on cpu 1 at 75.384100s:
[   81.188593][  T830]  __kmalloc_noprof (mm/slub.c:5658 mm/slub.c:5669)
[   81.189018][  T830]  sk_prot_alloc (./include/linux/slab.h:961 net/core/sock.c:2245)
[   81.189420][  T830]  sk_alloc (net/core/sock.c:2301)
[   81.189779][  T830]  nfc_llcp_sock_alloc (net/nfc/llcp_sock.c:979)
[   81.190222][  T830]  nfc_llcp_rx_skb (net/nfc/llcp_core.c:971 net/nfc/llcp_core.c:1478)
[   81.190656][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
[   81.193365][  T830] Freed by task 31 on cpu 196609 at 78.490492s:
[   81.195183][  T830]  kfree (mm/slub.c:6670 mm/slub.c:6878)
[   81.195531][  T830]  __sk_destruct (net/core/sock.c:2285 net/core/sock.c:2384)
[   81.195937][  T830]  nfc_llcp_rx_skb (.net/sock.h:? net/nfc/llcp_core.c:233 net/nfc/llcp_core.c:1194 net/nfc/llcp_core.c:1483)
[   81.196379][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
[   81.199084][  T830] The buggy address belongs to the object at ffff888119369800
[   81.199084][  T830]  which belongs to the cache kmalloc-1k of size 1024
[   81.200297][  T830] The buggy address is located 18 bytes inside of
[   81.200297][  T830]  freed 1024-byte region [ffff888119369800, ffff888119369c00)


Best,
Shuangpeng