Re: [PATCH net] net: tun: Update napi->skb after XDP process

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 17 Sep 2025 19:39:19 +0800 you wrote:
> The syzbot report a UAF issue:
> 
>   BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline]
>   BUG: KASAN: slab-use-after-free in napi_frags_skb net/core/gro.c:723 [inline]
>   BUG: KASAN: slab-use-after-free in napi_gro_frags+0x6e/0x1030 net/core/gro.c:758
>   Read of size 8 at addr ffff88802ef22c18 by task syz.0.17/6079
>   CPU: 0 UID: 0 PID: 6079 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
>   Call Trace:
>    <TASK>
>    dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
>    print_address_description mm/kasan/report.c:378 [inline]
>    print_report+0xca/0x240 mm/kasan/report.c:482
>    kasan_report+0x118/0x150 mm/kasan/report.c:595
>    skb_reset_mac_header include/linux/skbuff.h:3150 [inline]
>    napi_frags_skb net/core/gro.c:723 [inline]
>    napi_gro_frags+0x6e/0x1030 net/core/gro.c:758
>    tun_get_user+0x28cb/0x3e20 drivers/net/tun.c:1920
>    tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996
>    new_sync_write fs/read_write.c:593 [inline]
>    vfs_write+0x5c9/0xb30 fs/read_write.c:686
>    ksys_write+0x145/0x250 fs/read_write.c:738
>    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>    do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>    entry_SYSCALL_64_after_hwframe+0x77/0x7f
>    </TASK>
> 
> [...]

Here is the summary with links:
  - [net] net: tun: Update napi->skb after XDP process
    https://git.kernel.org/netdev/net/c/1091860a16a8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html