* Forwarded: [PATCH] atm: lec: fix use-after-free in send_to_lecd
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
@ 2026-03-09 4:56 ` syzbot
2026-03-09 5:24 ` Forwarded: " syzbot
` (11 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 4:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] atm: lec: fix use-after-free in send_to_lecd
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
In send_to_lecd(), the socket is extracted via sk_atm(priv->lecd)
without holding a reference. The APIC timer triggers a softirq which
runs RCU callbacks, and if the RCU grace period has elapsed, the socket
can be freed via rcu_do_batch() while send_to_lecd() is still accessing
it, triggering a use-after-free bug.
Fix this by adding sock_hold() before accessing the socket and
sock_put() after all usage is done to prevent premature freeing.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..4e752b4b623e 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -534,9 +534,9 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
-
if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
atm_force_charge(priv->lecd, data->truesize);
@@ -544,6 +544,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
sk->sk_data_ready(sk);
}
+ sock_put(sk);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Forwarded: Re: [PATCH] atm: lec: fix use-after-free in send_to_lecd
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
2026-03-09 4:56 ` Forwarded: [PATCH] atm: lec: fix use-after-free in send_to_lecd syzbot
@ 2026-03-09 5:24 ` syzbot
2026-03-09 6:28 ` Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable() syzbot
` (10 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 5:24 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] atm: lec: fix use-after-free in send_to_lecd
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
In send_to_lecd(), the socket is extracted via sk_atm(priv->lecd)
without holding a reference. The APIC timer triggers a softirq which
runs RCU callbacks, and if the RCU grace period has elapsed, the socket
can be freed via rcu_do_batch() while send_to_lecd() is still accessing
it, triggering a use-after-free bug.
Fix this by adding sock_hold() before accessing the socket and
sock_put() after all usage is done to prevent premature freeing.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..4e752b4b623e 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -534,9 +534,9 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
-
if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
atm_force_charge(priv->lecd, data->truesize);
@@ -544,6 +544,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
sk->sk_data_ready(sk);
}
+ sock_put(sk);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
2026-03-09 4:56 ` Forwarded: [PATCH] atm: lec: fix use-after-free in send_to_lecd syzbot
2026-03-09 5:24 ` Forwarded: " syzbot
@ 2026-03-09 6:28 ` syzbot
2026-03-09 7:02 ` syzbot
` (9 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 6:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A race condition exists between lec_atm_close() setting priv->lecd = NULL
and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(),
and lec_atm_send(). When the socket is freed via RCU while another thread
is still using it, a use-after-free occurs in sock_def_readable() when
accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without holding
lec_arp_lock, while callers dereference priv->lecd without any protection
against concurrent teardown.
Fix this by:
- Protecting priv->lecd = NULL in lec_atm_close() with lec_arp_lock to
synchronize with callers that already hold the lock (e.g. lec_arp_resolve)
- Using sock_hold/sock_put in send_to_lecd() to pin the socket while in
use. This is safe because send_to_lecd() is called under lec_arp_lock
by lec_arp_resolve(), preventing concurrent NULL assignment of lecd.
- Using lec_arp_lock + sock_hold/sock_put in lec_handle_bridge() and
lec_atm_send() where the lock is not held by the caller, with proper
skb cleanup on early exit to avoid memory leaks.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..7e051174a92b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -131,6 +131,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
{
char *buff;
struct lec_priv *priv;
+ unsigned long flags;
/*
* Check if this is a BPDU. If so, ask zeppelin to send
@@ -154,10 +155,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ return;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -441,7 +451,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
struct sock *sk;
-
+ unsigned long flags;
pr_debug("%s: entry found, responding to zeppelin\n",
dev->name);
skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
@@ -449,10 +459,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ break;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -471,8 +490,11 @@ static void lec_atm_close(struct atm_vcc *vcc)
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ unsigned long flags;
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
priv->lecd = NULL;
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
/* Do something needful? */
netif_stop_queue(dev);
@@ -534,6 +556,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
@@ -543,7 +566,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
-
+ sock_put(sk);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (2 preceding siblings ...)
2026-03-09 6:28 ` Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable() syzbot
@ 2026-03-09 7:02 ` syzbot
2026-03-09 7:53 ` syzbot
` (8 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 7:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A race condition exists between lec_atm_close() setting priv->lecd = NULL
and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(),
and lec_atm_send(). When the socket is freed via RCU while another thread
is still using it, a use-after-free occurs in sock_def_readable() when
accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without holding
lec_arp_lock, while callers dereference priv->lecd without any protection
against concurrent teardown.
Fix this by:
- Protecting priv->lecd = NULL in lec_atm_close() with lec_arp_lock to
synchronize with callers that already hold the lock (e.g. lec_arp_resolve)
- Using sock_hold/sock_put in send_to_lecd() to pin the socket while in
use. This is safe because send_to_lecd() is called under lec_arp_lock
by lec_arp_resolve(), preventing concurrent NULL assignment of lecd.
- Using lec_arp_lock + sock_hold/sock_put in lec_handle_bridge() and
lec_atm_send() where the lock is not held by the caller, with proper
skb cleanup on early exit to avoid memory leaks.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..7e051174a92b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -131,6 +131,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
{
char *buff;
struct lec_priv *priv;
+ unsigned long flags;
/*
* Check if this is a BPDU. If so, ask zeppelin to send
@@ -154,10 +155,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ return;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -441,7 +451,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
struct sock *sk;
-
+ unsigned long flags;
pr_debug("%s: entry found, responding to zeppelin\n",
dev->name);
skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
@@ -449,10 +459,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ break;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -471,8 +490,11 @@ static void lec_atm_close(struct atm_vcc *vcc)
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ unsigned long flags;
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
priv->lecd = NULL;
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
/* Do something needful? */
netif_stop_queue(dev);
@@ -534,6 +556,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
@@ -543,7 +566,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
-
+ sock_put(sk);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (3 preceding siblings ...)
2026-03-09 7:02 ` syzbot
@ 2026-03-09 7:53 ` syzbot
2026-03-09 8:21 ` syzbot
` (7 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 7:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A race condition exists between lec_atm_close() setting priv->lecd = NULL
and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(),
and lec_atm_send(). When the socket is freed via RCU while another thread
is still using it, a use-after-free occurs in sock_def_readable() when
accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without holding
lec_arp_lock, while callers dereference priv->lecd without any protection
against concurrent teardown.
Fix this by:
- Protecting priv->lecd = NULL in lec_atm_close() with lec_arp_lock to
synchronize with callers that already hold the lock (e.g. lec_arp_resolve)
- Using sock_hold/sock_put in send_to_lecd() to pin the socket while in
use. This is safe because send_to_lecd() is called under lec_arp_lock
by lec_arp_resolve(), preventing concurrent NULL assignment of lecd.
- Using lec_arp_lock + sock_hold/sock_put in lec_handle_bridge() and
lec_atm_send() where the lock is not held by the caller, with proper
skb cleanup on early exit to avoid memory leaks.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..7e051174a92b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -131,6 +131,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
{
char *buff;
struct lec_priv *priv;
+ unsigned long flags;
/*
* Check if this is a BPDU. If so, ask zeppelin to send
@@ -154,10 +155,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ return;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -441,7 +451,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
struct sock *sk;
-
+ unsigned long flags;
pr_debug("%s: entry found, responding to zeppelin\n",
dev->name);
skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
@@ -449,10 +459,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ break;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -471,8 +490,11 @@ static void lec_atm_close(struct atm_vcc *vcc)
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ unsigned long flags;
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
priv->lecd = NULL;
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
/* Do something needful? */
netif_stop_queue(dev);
@@ -534,6 +556,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
@@ -543,7 +566,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
-
+ sock_put(sk);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (4 preceding siblings ...)
2026-03-09 7:53 ` syzbot
@ 2026-03-09 8:21 ` syzbot
2026-03-09 9:20 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Jiayuan Chen
` (6 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 8:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A race condition exists between lec_atm_close() setting priv->lecd = NULL
and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(),
and lec_atm_send(). When the socket is freed via RCU while another thread
is still using it, a use-after-free occurs in sock_def_readable() when
accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without holding
lec_arp_lock, while callers dereference priv->lecd without any protection
against concurrent teardown.
Fix this by:
- Protecting priv->lecd = NULL in lec_atm_close() with lec_arp_lock to
synchronize with callers that already hold the lock (e.g. lec_arp_resolve)
- Using sock_hold/sock_put in send_to_lecd() to pin the socket while in
use. This is safe because send_to_lecd() is called under lec_arp_lock
by lec_arp_resolve(), preventing concurrent NULL assignment of lecd.
- Using lec_arp_lock + sock_hold/sock_put in lec_handle_bridge() and
lec_atm_send() where the lock is not held by the caller, with proper
skb cleanup on early exit to avoid memory leaks.
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..7e051174a92b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -131,6 +131,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
{
char *buff;
struct lec_priv *priv;
+ unsigned long flags;
/*
* Check if this is a BPDU. If so, ask zeppelin to send
@@ -154,10 +155,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ return;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -441,7 +451,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
struct sock *sk;
-
+ unsigned long flags;
pr_debug("%s: entry found, responding to zeppelin\n",
dev->name);
skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
@@ -449,10 +459,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ break;
+ }
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -471,8 +490,11 @@ static void lec_atm_close(struct atm_vcc *vcc)
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ unsigned long flags;
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
priv->lecd = NULL;
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
/* Do something needful? */
netif_stop_queue(dev);
@@ -534,6 +556,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
@@ -543,7 +566,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
-
+ sock_put(sk);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (5 preceding siblings ...)
2026-03-09 8:21 ` syzbot
@ 2026-03-09 9:20 ` Jiayuan Chen
2026-03-09 9:39 ` syzbot
2026-03-09 15:20 ` Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable() syzbot
` (5 subsequent siblings)
12 siblings, 1 reply; 27+ messages in thread
From: Jiayuan Chen @ 2026-03-09 9:20 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, netdev, syzkaller-bugs
#syz test
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 7e6fc2bd40ac..7d99ba8ba3b4 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -139,6 +139,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
*/
buff = skb->data + skb->dev->hard_header_len;
if (*buff++ == 0x42 && *buff++ == 0x42 && *buff++ == 0x03) {
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb2;
struct atmlec_msg *mesg;
@@ -154,10 +155,18 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
int is_rdesc;
pr_debug("called\n");
- if (!priv->lecd) {
+ if (!rcu_access_pointer(priv->lecd)) {
pr_info("%s:No lecd attached\n", dev->name);
dev->stats.tx_errors++;
netif_stop_queue(dev);
@@ -440,6 +449,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
if (br_fdb_test_addr_hook(dev, mesg->content.proxy.mac_addr)) {
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
+ struct atm_vcc *lecd;
struct sock *sk;
pr_debug("%s: entry found, responding to zeppelin\n",
@@ -449,10 +459,18 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+
+ rcu_read_lock();
+ lecd = rcu_dereference(priv->lecd);
+ if (lecd) {
+ atm_force_charge(lecd, skb2->truesize);
+ sk = sk_atm(lecd);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -472,7 +490,8 @@ static void lec_atm_close(struct atm_vcc *vcc)
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
- priv->lecd = NULL;
+ rcu_assign_pointer(priv->lecd, NULL);
+ synchronize_rcu();
/* Do something needful? */
netif_stop_queue(dev);
@@ -510,15 +529,25 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
const unsigned char *mac_addr, const unsigned char *atm_addr,
struct sk_buff *data)
{
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb;
struct atmlec_msg *mesg;
- if (!priv || !priv->lecd)
+ if (!priv)
+ return -1;
+
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (!vcc) {
+ rcu_read_unlock();
return -1;
+ }
skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
- if (!skb)
+ if (!skb) {
+ rcu_read_unlock();
return -1;
+ }
skb->len = sizeof(struct atmlec_msg);
mesg = (struct atmlec_msg *)skb->data;
memset(mesg, 0, sizeof(struct atmlec_msg));
@@ -532,18 +561,19 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
if (atm_addr)
memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
- atm_force_charge(priv->lecd, skb->truesize);
- sk = sk_atm(priv->lecd);
+ atm_force_charge(vcc, skb->truesize);
+ sk = sk_atm(vcc);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
- atm_force_charge(priv->lecd, data->truesize);
+ atm_force_charge(vcc, data->truesize);
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
+ rcu_read_unlock();
return 0;
}
@@ -618,7 +648,8 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
atm_return(vcc, skb->truesize);
if (*(__be16 *) skb->data == htons(priv->lecid) ||
- !priv->lecd || !(dev->flags & IFF_UP)) {
+ !rcu_access_pointer(priv->lecd) ||
+ !(dev->flags & IFF_UP)) {
/*
* Probably looping back, or if lecd is missing,
* lecd has gone down
@@ -753,12 +784,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
priv = netdev_priv(dev_lec[i]);
} else {
priv = netdev_priv(dev_lec[i]);
- if (priv->lecd)
+ if (rcu_access_pointer(priv->lecd))
return -EADDRINUSE;
}
lec_arp_init(priv);
priv->itfnum = i; /* LANE2 addition */
- priv->lecd = vcc;
+ rcu_assign_pointer(priv->lecd, vcc);
vcc->dev = &lecatm_dev;
vcc_insert_socket(sk_atm(vcc));
diff --git a/net/atm/lec.h b/net/atm/lec.h
index be0e2667bd8c..ec85709bf818 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -91,7 +91,7 @@ struct lec_priv {
*/
spinlock_t lec_arp_lock;
struct atm_vcc *mcast_vcc; /* Default Multicast Send VCC */
- struct atm_vcc *lecd;
+ struct atm_vcc __rcu *lecd;
struct delayed_work lec_arp_work; /* C10 */
unsigned int maximum_unknown_frame_count;
/*
^ permalink raw reply related [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-09 9:20 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Jiayuan Chen
@ 2026-03-09 9:39 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 9:39 UTC (permalink / raw)
To: jiayuan.chen, linux-kernel, netdev, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy syz-execprog to VM: failed to run ["scp" "-P" "48817" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@localhost:/syz-execprog"]: exit status 255
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3224921581=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cc2JgryH.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 1f318b96 Linux 7.0-rc3
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1528375a580000
^ permalink raw reply [flat|nested] 27+ messages in thread
* Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (6 preceding siblings ...)
2026-03-09 9:20 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Jiayuan Chen
@ 2026-03-09 15:20 ` syzbot
2026-03-12 2:26 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Hillf Danton
` (4 subsequent siblings)
12 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-09 15:20 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
A race condition exists between lec_atm_close() setting priv->lecd
to NULL and concurrent access to priv->lecd in send_to_lecd(),
lec_handle_bridge(), and lec_atm_send(). When the socket is freed
via RCU while another thread is still using it, a use-after-free
occurs in sock_def_readable() when accessing the socket's wait queue.
The root cause is that lec_atm_close() clears priv->lecd without
any synchronization, while callers dereference priv->lecd without
any protection against concurrent teardown.
Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()
for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference
the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and
lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),
lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in
lec_atm_close() to ensure all readers have completed before
proceeding. This is safe since lec_atm_close() is called from
vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close()
since vcc_destroy_socket() already drains it after lec_atm_close()
returns.
v2: Switch from spinlock + sock_hold/put approach to RCU to properly
fix the race. The v1 spinlock approach had two issues pointed out
by Eric Dumazet:
1. priv->lecd was still accessed directly after releasing the
lock instead of using a local copy.
2. The spinlock did not prevent packets being queued after
lec_atm_close() drains sk_receive_queue since timer and
workqueue paths bypass netif_stop_queue().
Reported-by: syzbot+f50072212ab792c86925@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Link: https://lore.kernel.org/all/20260309093614.502094-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
net/atm/lec.c | 70 +++++++++++++++++++++++++++++++++------------------
net/atm/lec.h | 2 +-
2 files changed, 46 insertions(+), 26 deletions(-)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..32adf28663a0 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -154,10 +154,18 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */
priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+ struct atm_vcc *vcc;
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +224,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
int is_rdesc;
pr_debug("called\n");
- if (!priv->lecd) {
+ if (!rcu_access_pointer(priv->lecd)) {
pr_info("%s:No lecd attached\n", dev->name);
dev->stats.tx_errors++;
netif_stop_queue(dev);
@@ -449,10 +457,18 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+ struct atm_vcc *vcc;
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -468,23 +484,16 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
static void lec_atm_close(struct atm_vcc *vcc)
{
- struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
- priv->lecd = NULL;
+ rcu_assign_pointer(priv->lecd, NULL);
+ synchronize_rcu();
/* Do something needful? */
netif_stop_queue(dev);
lec_arp_destroy(priv);
- if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
- pr_info("%s closing with messages pending\n", dev->name);
- while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
- atm_return(vcc, skb->truesize);
- dev_kfree_skb(skb);
- }
-
pr_info("%s: Shut down!\n", dev->name);
module_put(THIS_MODULE);
}
@@ -510,12 +519,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
const unsigned char *mac_addr, const unsigned char *atm_addr,
struct sk_buff *data)
{
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb;
struct atmlec_msg *mesg;
- if (!priv || !priv->lecd)
+ if (!priv || !rcu_access_pointer(priv->lecd))
return -1;
+
skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
if (!skb)
return -1;
@@ -532,18 +543,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
if (atm_addr)
memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
- atm_force_charge(priv->lecd, skb->truesize);
- sk = sk_atm(priv->lecd);
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (!vcc) {
+ rcu_read_unlock();
+ kfree_skb(skb);
+ return -1;
+ }
+
+ atm_force_charge(vcc, skb->truesize);
+ sk = sk_atm(vcc);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
- atm_force_charge(priv->lecd, data->truesize);
+ atm_force_charge(vcc, data->truesize);
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
+ rcu_read_unlock();
return 0;
}
@@ -618,7 +638,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
atm_return(vcc, skb->truesize);
if (*(__be16 *) skb->data == htons(priv->lecid) ||
- !priv->lecd || !(dev->flags & IFF_UP)) {
+ !rcu_access_pointer(priv->lecd) || !(dev->flags & IFF_UP)) {
/*
* Probably looping back, or if lecd is missing,
* lecd has gone down
@@ -753,12 +773,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
priv = netdev_priv(dev_lec[i]);
} else {
priv = netdev_priv(dev_lec[i]);
- if (priv->lecd)
+ if (rcu_access_pointer(priv->lecd))
return -EADDRINUSE;
}
lec_arp_init(priv);
priv->itfnum = i; /* LANE2 addition */
- priv->lecd = vcc;
+ rcu_assign_pointer(priv->lecd, vcc);
vcc->dev = &lecatm_dev;
vcc_insert_socket(sk_atm(vcc));
diff --git a/net/atm/lec.h b/net/atm/lec.h
index be0e2667bd8c..ec85709bf818 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -91,7 +91,7 @@ struct lec_priv {
*/
spinlock_t lec_arp_lock;
struct atm_vcc *mcast_vcc; /* Default Multicast Send VCC */
- struct atm_vcc *lecd;
+ struct atm_vcc __rcu *lecd;
struct delayed_work lec_arp_work; /* C10 */
unsigned int maximum_unknown_frame_count;
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (7 preceding siblings ...)
2026-03-09 15:20 ` Forwarded: [PATCH] atm: lec: fix use-after-free in sock_def_readable() syzbot
@ 2026-03-12 2:26 ` Hillf Danton
2026-03-12 2:46 ` syzbot
2026-03-12 6:35 ` Hillf Danton
` (3 subsequent siblings)
12 siblings, 1 reply; 27+ messages in thread
From: Hillf Danton @ 2026-03-12 2:26 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
#syz test
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -471,12 +471,14 @@ static void lec_atm_close(struct atm_vcc
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ struct sock *sk = sk_atm(priv->lecd);
priv->lecd = NULL;
/* Do something needful? */
netif_stop_queue(dev);
lec_arp_destroy(priv);
+ sock_put(sk);
if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
pr_info("%s closing with messages pending\n", dev->name);
@@ -761,6 +763,7 @@ static int lecd_attach(struct atm_vcc *v
priv->lecd = vcc;
vcc->dev = &lecatm_dev;
vcc_insert_socket(sk_atm(vcc));
+ sock_hold(sk_atm(vcc));
vcc->proto_data = dev_lec[i];
set_bit(ATM_VF_META, &vcc->flags);
--
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-12 2:26 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Hillf Danton
@ 2026-03-12 2:46 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-12 2:46 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in sock_def_readable
==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in wq_has_sleeper include/linux/wait.h:161 [inline]
BUG: KASAN: slab-use-after-free in skwq_has_sleeper include/net/sock.h:2404 [inline]
BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
Read of size 8 at addr ffff88804a44dd40 by task kworker/0:3/1105
CPU: 0 UID: 0 PID: 1105 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: mld mld_ifc_work
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
waitqueue_active include/linux/wait.h:127 [inline]
wq_has_sleeper include/linux/wait.h:161 [inline]
skwq_has_sleeper include/net/sock.h:2404 [inline]
sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
send_to_lecd+0x322/0x600 net/atm/lec.c:540
lec_arp_resolve net/atm/lec.c:1794 [inline]
lec_start_xmit+0xec0/0x2660 net/atm/lec.c:285
__netdev_start_xmit include/linux/netdevice.h:5292 [inline]
netdev_start_xmit include/linux/netdevice.h:5301 [inline]
xmit_one net/core/dev.c:3871 [inline]
dev_hard_start_xmit+0x2d8/0x870 net/core/dev.c:3887
sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347
__dev_xmit_skb net/core/dev.c:4186 [inline]
__dev_queue_xmit+0x1550/0x3890 net/core/dev.c:4802
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x2e5/0x740 net/ipv6/ip6_output.c:219
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:470 [inline]
NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:318
mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5809:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4542 [inline]
slab_alloc_node mm/slub.c:4869 [inline]
kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4888
sock_alloc_inode+0x28/0xc0 net/socket.c:322
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:637 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1569
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xd6/0x1b0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5818:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2692 [inline]
slab_free mm/slub.c:6168 [inline]
kmem_cache_free+0x187/0x630 mm/slub.c:6298
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3131 [inline]
call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
destroy_inode fs/inode.c:402 [inline]
evict+0x95b/0xb10 fs/inode.c:870
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
__fput+0x691/0xa70 fs/file_table.c:477
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88804a44dcc0
which belongs to the cache sock_inode_cache of size 1344
The buggy address is located 128 bytes inside of
freed 1344-byte region [ffff88804a44dcc0, ffff88804a44e200)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4a44c
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88804a44ff41
flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000040 ffff888030465500 dead000000000122 0000000000000000
raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff88804a44ff41
head: 04fff00000000040 ffff888030465500 dead000000000122 0000000000000000
head: 0000000000000000 00000008000b000b 00000000f5000000 ffff88804a44ff41
head: 04fff00000000002 ffffea0001291301 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5752, tgid 5752 (syz-executor), ts 178422438569, free_ts 113142646262
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3296 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3485
new_slab mm/slub.c:3543 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7178
__pcs_replace_empty_main+0x2f9/0x5e0 mm/slub.c:-1
alloc_from_pcs mm/slub.c:4720 [inline]
slab_alloc_node mm/slub.c:4854 [inline]
kmem_cache_alloc_lru_noprof+0x37c/0x640 mm/slub.c:4888
sock_alloc_inode+0x28/0xc0 net/socket.c:322
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:637 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1569
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xd6/0x1b0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 4707 tgid 4707 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
__slab_free+0x263/0x2b0 mm/slub.c:5576
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4542 [inline]
slab_alloc_node mm/slub.c:4869 [inline]
kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4921
__alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0xca/0x890 net/core/skbuff.c:6763
sock_alloc_send_pskb+0x878/0x990 net/core/sock.c:2995
unix_dgram_sendmsg+0x4fb/0x18d0 net/unix/af_unix.c:2125
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x672/0x710 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804a44dc00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88804a44dc80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff88804a44dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88804a44dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804a44de00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Tested on:
commit: 80234b5a Merge tag 'rproc-v7.0-fixes' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15bcef5a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=107fb75a580000
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (8 preceding siblings ...)
2026-03-12 2:26 ` [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) Hillf Danton
@ 2026-03-12 6:35 ` Hillf Danton
2026-03-12 6:53 ` syzbot
2026-03-12 7:37 ` Hillf Danton
` (2 subsequent siblings)
12 siblings, 1 reply; 27+ messages in thread
From: Hillf Danton @ 2026-03-12 6:35 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
#syz test
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
priv->lecd = NULL;
/* Do something needful? */
+ synchronize_rcu();
netif_stop_queue(dev);
lec_arp_destroy(priv);
--
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-12 6:35 ` Hillf Danton
@ 2026-03-12 6:53 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-12 6:53 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to copy prog to VM: failed to run ["scp" "-P" "10667" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syzkaller2428577641" "root@localhost:/syzkaller2428577641"]: exit status 255
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4120003145=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cc1EmJT5.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 80234b5a Merge tag 'rproc-v7.0-fixes' of git://git.ker..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1188cd52580000
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (9 preceding siblings ...)
2026-03-12 6:35 ` Hillf Danton
@ 2026-03-12 7:37 ` Hillf Danton
2026-03-12 7:57 ` syzbot
2026-03-12 22:02 ` Hillf Danton
2026-03-13 18:44 ` Hillf Danton
12 siblings, 1 reply; 27+ messages in thread
From: Hillf Danton @ 2026-03-12 7:37 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
#syz test upstream master
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
priv->lecd = NULL;
/* Do something needful? */
+ synchronize_rcu();
netif_stop_queue(dev);
lec_arp_destroy(priv);
--
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (10 preceding siblings ...)
2026-03-12 7:37 ` Hillf Danton
@ 2026-03-12 22:02 ` Hillf Danton
2026-03-12 22:22 ` syzbot
2026-03-13 18:44 ` Hillf Danton
12 siblings, 1 reply; 27+ messages in thread
From: Hillf Danton @ 2026-03-12 22:02 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
#syz test upstream master
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
priv->lecd = NULL;
/* Do something needful? */
+ synchronize_rcu();
netif_stop_queue(dev);
lec_arp_destroy(priv);
--
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-12 22:02 ` Hillf Danton
@ 2026-03-12 22:22 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-12 22:22 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
lost connection to test machine
syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
Warning: Permanently added '[localhost]:9504' (ED25519) to the list of known hosts.
2026/03/12 22:20:27 parsed 1 programs
[ 135.338848][ T5316] cgroup: Unknown subsys name 'net'
[ 135.396122][ T5316] cgroup: Unknown subsys name 'cpuset'
[ 135.403015][ T5316] cgroup: Unknown subsys name 'rlimit'
[ 143.433872][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[ 143.437206][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[ 188.890546][ T1009] ata1.00: NCQ disabled due to excessive errors
[ 188.893607][ T1009] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[ 188.898202][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 188.902723][ T1009] ata1.00: cmd 61/00:70:26:5e:04/20:00:00:00:00/40 tag 14 ncq dma 4194304 ou
[ 188.902723][ T1009] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 188.911375][ T1009] ata1.00: status: { DRDY }
[ 188.913896][ T1009] ata1: hard resetting link
[ 189.233766][ T1009] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 189.239363][ T1009] ata1.00: configured for UDMA/100
[ 189.243584][ T1009] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2904551795=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/cctV4tEl.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 0257f64b Merge tag 'pm-7.0-rc4' of git://git.kernel.or..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14940b88580000
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-08 13:42 [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2) syzbot
` (11 preceding siblings ...)
2026-03-12 22:02 ` Hillf Danton
@ 2026-03-13 18:44 ` Hillf Danton
2026-03-13 19:02 ` syzbot
12 siblings, 1 reply; 27+ messages in thread
From: Hillf Danton @ 2026-03-13 18:44 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
#syz test: upstream 651690480a96
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -474,6 +474,7 @@ static void lec_atm_close(struct atm_vcc
priv->lecd = NULL;
/* Do something needful? */
+ synchronize_rcu();
netif_stop_queue(dev);
lec_arp_destroy(priv);
--
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)
2026-03-13 18:44 ` Hillf Danton
@ 2026-03-13 19:02 ` syzbot
0 siblings, 0 replies; 27+ messages in thread
From: syzbot @ 2026-03-13 19:02 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
lost connection to test machine
syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0xfb000)
[ 97.299132][ T10] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:10854' (ED25519) to the list of known hosts.
2026/03/13 19:00:35 parsed 1 programs
[ 105.586401][ T5314] cgroup: Unknown subsys name 'net'
[ 105.643957][ T5314] cgroup: Unknown subsys name 'cpuset'
[ 105.650699][ T5314] cgroup: Unknown subsys name 'rlimit'
[ 143.372540][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[ 143.376030][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[ 156.189227][ T1011] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[ 156.193435][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[ 156.196306][ T1011] ata1.00: cmd 61/d8:70:36:61:04/07:00:00:00:00/40 tag 14 ncq dma 1028096 ou
[ 156.196306][ T1011] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 156.205965][ T1011] ata1.00: status: { DRDY }
[ 156.208393][ T1011] ata1: hard resetting link
[ 156.531189][ T1011] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 156.536384][ T1011] ata1.00: configured for UDMA/100
[ 156.539569][ T1011] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x2bb000)
[ 156.595084][ T1011] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 156.598460][ T1011] ata1: failed to read log page 10h (errno=-5)
[ 156.619268][ T1011] ata1.00: NCQ disabled due to excessive errors
[ 156.622929][ T1011] ata1.00: exception Emask 0x1 SAct 0x1e00 SErr 0x0 action 0x0
[ 156.627134][ T1011] ata1.00: irq_stat 0x41000008
[ 156.639141][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[ 156.642238][ T1011] ata1.00: cmd 61/d8:48:86:a2:04/02:00:00:00:00/40 tag 9 ncq dma 372736 out
[ 156.642238][ T1011] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 156.679095][ T1011] ata1.00: status: { DRDY }
[ 156.681893][ T1011] ata1.00: error: { ABRT }
[ 156.684701][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[ 156.699416][ T1011] ata1.00: cmd 61/00:50:5e:a5:04/06:00:00:00:00/40 tag 10 ncq dma 786432 out
[ 156.699416][ T1011] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 156.707246][ T1011] ata1.00: status: { DRDY }
[ 156.718658][ T1011] ata1.00: error: { ABRT }
[ 156.720862][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[ 156.723709][ T1011] ata1.00: cmd 61/d8:58:5e:ab:04/15:00:00:00:00/40 tag 11 ncq dma 2863104 ou
[ 156.723709][ T1011] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 156.742964][ T1011] ata1.00: status: { DRDY }
[ 156.745213][ T1011] ata1.00: error: { ABRT }
[ 156.747285][ T1011] ata1.00: failed command: WRITE FPDMA QUEUED
[ 156.750902][ T1011] ata1.00: cmd 61/00:60:36:c1:04/20:00:00:00:00/40 tag 12 ncq dma 4194304 ou
[ 156.750902][ T1011] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 156.760311][ T1011] ata1.00: status: { DRDY }
[ 156.762534][ T1011] ata1.00: error: { ABRT }
[ 156.766637][ T1011] ata1.00: configured for UDMA/100
[ 156.770968][ T1011] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build649871866=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/ccZ4u7l4.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 65169048 Merge tag 'spi-fix-v7.0-rc2' of git://git.ker..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=16822776580000
^ permalink raw reply [flat|nested] 27+ messages in thread