Re: [syzbot] [x25?] possible deadlock in lapb_data_received

[Hillf Danton <hdanton@sina.com>]

> Date: Mon, 19 Oct 2026 12:20:19 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    2c7935600733 Merge branch 'bpf-zero-extend-the-index-in-in..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=13598f01580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=964a8fc052e56fe5
> dashboard link: https://syzkaller.appspot.com/bug?extid=059a2795ad4cff2a2695
> compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=117c5031580000

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git 2c7935600733

--- x/drivers/net/wan/lapbether.c
+++ y/drivers/net/wan/lapbether.c
@@ -139,7 +139,10 @@ static int lapbeth_rcv(struct sk_buff *s
 	skb_pull(skb, 2);	/* Remove the length bytes */
 	skb_trim(skb, len);	/* Set the length of the data */
 
+	/* still with rcu lock held */
+	spin_unlock_bh(&lapbeth->up_lock);
 	err = lapb_data_received(lapbeth->axdev, skb);
+	spin_lock_bh(&lapbeth->up_lock);
 	if (err != LAPB_OK) {
 		printk(KERN_DEBUG "lapbether: lapb_data_received err - %d\n", err);
 		goto drop_unlock;
@@ -343,6 +346,7 @@ static int lapbeth_close(struct net_devi
 	struct lapbethdev *lapbeth = netdev_priv(dev);
 	int err;
 
+	synchronize_rcu();
 	spin_lock_bh(&lapbeth->up_lock);
 	lapbeth->up = false;
 	spin_unlock_bh(&lapbeth->up_lock);
--