[PATCH net] net/x25: fix use-after-free in x25_kill_by_neigh()

[Baul Lee <baul.lee@xbow.com>]

x25_kill_by_neigh() walks x25_list under x25_list_lock and, for every
socket bound to the dying neighbour, drops the lock to call lock_sock() /
x25_disconnect() / release_sock() before re-acquiring it and continuing
the iteration.  It holds no reference on the socket across this window.

A concurrent x25_release() on the same socket can therefore
sk_del_node() and free it while the lock is dropped, so the following
lock_sock(s) operates on freed memory; the sk_for_each() cursor can also
be advanced through the freed node once the lock is re-acquired.  Either
way an X.25 device going down races a socket close into a slab
use-after-free.

Take a reference with sock_hold() before dropping the lock so the socket
stays alive across lock_sock()/x25_disconnect()/release_sock(), and drop
it with sock_put() after the lock is re-acquired.  Because the socket may
have been unlinked from x25_list during the window, restart the walk from
the head instead of advancing from the (possibly unlinked) cursor;
x25_disconnect() clears x25_sk(s)->neighbour, so an already-handled
socket no longer matches and the walk terminates.  This mirrors the
reference-holding list walkers already used elsewhere in this file.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Reported privately to the maintainers on 2026-07-09 with root-cause
analysis, a PoC, a KASAN log and this fix; posting to the list was
requested as the follow-up.

Fixes: 7781607938c8 ("net/x25: Fix null-ptr-deref caused by x25_disconnect")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
Reported-by: Baul Lee <baul.lee@xbow.com>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
---
 net/x25/af_x25.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index c31d2af5dd22..68c396dc4307 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1770,13 +1770,17 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
 
 	write_lock_bh(&x25_list_lock);
 
+restart:
 	sk_for_each(s, &x25_list) {
 		if (x25_sk(s)->neighbour == nb) {
+			sock_hold(s);
 			write_unlock_bh(&x25_list_lock);
 			lock_sock(s);
 			x25_disconnect(s, ENETUNREACH, 0, 0);
 			release_sock(s);
 			write_lock_bh(&x25_list_lock);
+			sock_put(s);
+			goto restart;
 		}
 	}
 	write_unlock_bh(&x25_list_lock);
-- 
2.50.1 (Apple Git-155)