* [BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb
@ 2026-08-19 0:20 Shuangpeng Bai
2026-08-19 7:55 ` Eric Dumazet
0 siblings, 1 reply; 2+ messages in thread
From: Shuangpeng Bai @ 2026-08-19 0:20 UTC (permalink / raw)
To: David Heidelberg, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuangpeng Bai, oe-linux-nfc, netdev, linux-kernel
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in nfc_llcp_rx_skb
on commit: 3609fa95fb0f2c1b099e69e56634edb8fc03f87c (2026-01-04)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/70e3bdc241dbd675970fe89f30f0b84e
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Decoded source path:
use: net/nfc/llcp_core.c:1185 in nfc_llcp_recv_disc(), reading sk->sk_state
after nfc_llcp_sock_put() at line 1182; DISC dispatch is called from
net/nfc/llcp_core.c:1483 in nfc_llcp_rx_skb().
free: concurrent socket release drops the final reference through
net/nfc/llcp_sock.c:646 sock_put(), then sk_free() releases the same
struct nfc_llcp_sock allocation.
[ 81.172360][ T830] BUG: KASAN: slab-use-after-free in nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
[ 81.173044][ T830] Read of size 1 at addr ffff888119369812 by task kworker/1:2/830
[ 81.173940][ T830] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 81.173941][ T830] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 81.173943][ T830] Workqueue: events nfc_llcp_rx_work
[ 81.173946][ T830] Call Trace:
[ 81.173947][ T830] <TASK>
[ 81.173952][ T830] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[ 81.173959][ T830] kasan_report (mm/kasan/report.c:597)
[ 81.173965][ T830] nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
[ 81.173973][ T830] nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
[ 81.173976][ T830] process_scheduled_works (kernel/workqueue.c:3262 kernel/workqueue.c:3340)
[ 81.173980][ T830] worker_thread (./include/linux/list.h:381 kernel/workqueue.c:946 kernel/workqueue.c:3422)
[ 81.173984][ T830] kthread (kernel/kthread.c:465)
[ 81.174000][ T830] ret_from_fork (archkernel/process.c:164)
[ 81.174011][ T830] ret_from_fork_asm (arch/x86/entry/entry_64.S:256)
[ 81.174014][ T830] </TASK>
[ 81.187221][ T830] Allocated by task 4409 on cpu 1 at 75.384100s:
[ 81.188593][ T830] __kmalloc_noprof (mm/slub.c:5658 mm/slub.c:5669)
[ 81.189018][ T830] sk_prot_alloc (./include/linux/slab.h:961 net/core/sock.c:2245)
[ 81.189420][ T830] sk_alloc (net/core/sock.c:2301)
[ 81.189779][ T830] nfc_llcp_sock_alloc (net/nfc/llcp_sock.c:979)
[ 81.190222][ T830] nfc_llcp_rx_skb (net/nfc/llcp_core.c:971 net/nfc/llcp_core.c:1478)
[ 81.190656][ T830] nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
[ 81.193365][ T830] Freed by task 31 on cpu 196609 at 78.490492s:
[ 81.195183][ T830] kfree (mm/slub.c:6670 mm/slub.c:6878)
[ 81.195531][ T830] __sk_destruct (net/core/sock.c:2285 net/core/sock.c:2384)
[ 81.195937][ T830] nfc_llcp_rx_skb (.net/sock.h:? net/nfc/llcp_core.c:233 net/nfc/llcp_core.c:1194 net/nfc/llcp_core.c:1483)
[ 81.196379][ T830] nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
[ 81.199084][ T830] The buggy address belongs to the object at ffff888119369800
[ 81.199084][ T830] which belongs to the cache kmalloc-1k of size 1024
[ 81.200297][ T830] The buggy address is located 18 bytes inside of
[ 81.200297][ T830] freed 1024-byte region [ffff888119369800, ffff888119369c00)
Best,
Shuangpeng
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb
2026-08-19 0:20 [BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb Shuangpeng Bai
@ 2026-08-19 7:55 ` Eric Dumazet
0 siblings, 0 replies; 2+ messages in thread
From: Eric Dumazet @ 2026-08-19 7:55 UTC (permalink / raw)
To: Shuangpeng Bai
Cc: David Heidelberg, David S. Miller, Jakub Kicinski, Paolo Abeni,
oe-linux-nfc, netdev, linux-kernel
On Wed, Aug 19, 2026 at 2:21 AM Shuangpeng Bai
<shuangpeng.kernel@gmail.com> wrote:
>
> Hi Kernel Maintainers,
>
> I hit the following report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in nfc_llcp_rx_skb
>
> on commit: 3609fa95fb0f2c1b099e69e56634edb8fc03f87c (2026-01-04)
Are you sure this was not already fixed by 2b5dd4632966
("nfc: llcp: add missing return after LLCP_CLOSED checks") ?
>
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/70e3bdc241dbd675970fe89f30f0b84e
>
> I'm happy to test debug patches or provide additional information.
>
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
>
> Decoded source path:
>
> use: net/nfc/llcp_core.c:1185 in nfc_llcp_recv_disc(), reading sk->sk_state
> after nfc_llcp_sock_put() at line 1182; DISC dispatch is called from
> net/nfc/llcp_core.c:1483 in nfc_llcp_rx_skb().
> free: concurrent socket release drops the final reference through
> net/nfc/llcp_sock.c:646 sock_put(), then sk_free() releases the same
> struct nfc_llcp_sock allocation.
>
> [ 81.172360][ T830] BUG: KASAN: slab-use-after-free in nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
> [ 81.173044][ T830] Read of size 1 at addr ffff888119369812 by task kworker/1:2/830
> [ 81.173940][ T830] Tainted: [B]=BAD_PAGE, [W]=WARN
> [ 81.173941][ T830] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [ 81.173943][ T830] Workqueue: events nfc_llcp_rx_work
> [ 81.173946][ T830] Call Trace:
> [ 81.173947][ T830] <TASK>
> [ 81.173952][ T830] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> [ 81.173959][ T830] kasan_report (mm/kasan/report.c:597)
> [ 81.173965][ T830] nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
> [ 81.173973][ T830] nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
> [ 81.173976][ T830] process_scheduled_works (kernel/workqueue.c:3262 kernel/workqueue.c:3340)
> [ 81.173980][ T830] worker_thread (./include/linux/list.h:381 kernel/workqueue.c:946 kernel/workqueue.c:3422)
> [ 81.173984][ T830] kthread (kernel/kthread.c:465)
> [ 81.174000][ T830] ret_from_fork (archkernel/process.c:164)
> [ 81.174011][ T830] ret_from_fork_asm (arch/x86/entry/entry_64.S:256)
> [ 81.174014][ T830] </TASK>
> [ 81.187221][ T830] Allocated by task 4409 on cpu 1 at 75.384100s:
> [ 81.188593][ T830] __kmalloc_noprof (mm/slub.c:5658 mm/slub.c:5669)
> [ 81.189018][ T830] sk_prot_alloc (./include/linux/slab.h:961 net/core/sock.c:2245)
> [ 81.189420][ T830] sk_alloc (net/core/sock.c:2301)
> [ 81.189779][ T830] nfc_llcp_sock_alloc (net/nfc/llcp_sock.c:979)
> [ 81.190222][ T830] nfc_llcp_rx_skb (net/nfc/llcp_core.c:971 net/nfc/llcp_core.c:1478)
> [ 81.190656][ T830] nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
> [ 81.193365][ T830] Freed by task 31 on cpu 196609 at 78.490492s:
> [ 81.195183][ T830] kfree (mm/slub.c:6670 mm/slub.c:6878)
> [ 81.195531][ T830] __sk_destruct (net/core/sock.c:2285 net/core/sock.c:2384)
> [ 81.195937][ T830] nfc_llcp_rx_skb (.net/sock.h:? net/nfc/llcp_core.c:233 net/nfc/llcp_core.c:1194 net/nfc/llcp_core.c:1483)
> [ 81.196379][ T830] nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
> [ 81.199084][ T830] The buggy address belongs to the object at ffff888119369800
> [ 81.199084][ T830] which belongs to the cache kmalloc-1k of size 1024
> [ 81.200297][ T830] The buggy address is located 18 bytes inside of
> [ 81.200297][ T830] freed 1024-byte region [ffff888119369800, ffff888119369c00)
>
>
> Best,
> Shuangpeng
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-19 7:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-19 0:20 [BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb Shuangpeng Bai
2026-08-19 7:55 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox