Re: [BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb

[Shuangpeng <shuangpeng.kernel@gmail.com>]

> On Aug 19, 2026, at 03:55, Eric Dumazet <edumazet@google.com> wrote:
> 
> On Wed, Aug 19, 2026 at 2:21 AM Shuangpeng Bai
> <shuangpeng.kernel@gmail.com> wrote:
>> 
>> Hi Kernel Maintainers,
>> 
>> I hit the following report while testing current upstream kernel:
>> 
>> KASAN: slab-use-after-free in nfc_llcp_rx_skb
>> 
>> on commit: 3609fa95fb0f2c1b099e69e56634edb8fc03f87c (2026-01-04)
> 
> Are you sure this was not already fixed by 2b5dd4632966
> ("nfc: llcp: add missing return after LLCP_CLOSED checks") ?
> 

You're right. I overlooked commit 2b5dd4632966. I confirmed that this issue
has already been fixed by it.
Sorry for the noise, and thanks for pointing it out.

>> 
>> The reproducer and .config files are here.
>> https://gist.github.com/shuangpengbai/70e3bdc241dbd675970fe89f30f0b84e
>> 
>> I'm happy to test debug patches or provide additional information.
>> 
>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
>> 
>> Decoded source path:
>> 
>> use: net/nfc/llcp_core.c:1185 in nfc_llcp_recv_disc(), reading sk->sk_state
>>     after nfc_llcp_sock_put() at line 1182; DISC dispatch is called from
>>     net/nfc/llcp_core.c:1483 in nfc_llcp_rx_skb().
>> free: concurrent socket release drops the final reference through
>>      net/nfc/llcp_sock.c:646 sock_put(), then sk_free() releases the same
>>      struct nfc_llcp_sock allocation.
>> 
>> [   81.172360][  T830] BUG: KASAN: slab-use-after-free in nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
>> [   81.173044][  T830] Read of size 1 at addr ffff888119369812 by task kworker/1:2/830
>> [   81.173940][  T830] Tainted: [B]=BAD_PAGE, [W]=WARN
>> [   81.173941][  T830] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
>> [   81.173943][  T830] Workqueue: events nfc_llcp_rx_work
>> [   81.173946][  T830] Call Trace:
>> [   81.173947][  T830]  <TASK>
>> [   81.173952][  T830]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
>> [   81.173959][  T830]  kasan_report (mm/kasan/report.c:597)
>> [   81.173965][  T830]  nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
>> [   81.173973][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
>> [   81.173976][  T830]  process_scheduled_works (kernel/workqueue.c:3262 kernel/workqueue.c:3340)
>> [   81.173980][  T830]  worker_thread (./include/linux/list.h:381 kernel/workqueue.c:946 kernel/workqueue.c:3422)
>> [   81.173984][  T830]  kthread (kernel/kthread.c:465)
>> [   81.174000][  T830]  ret_from_fork (archkernel/process.c:164)
>> [   81.174011][  T830]  ret_from_fork_asm (arch/x86/entry/entry_64.S:256)
>> [   81.174014][  T830]  </TASK>
>> [   81.187221][  T830] Allocated by task 4409 on cpu 1 at 75.384100s:
>> [   81.188593][  T830]  __kmalloc_noprof (mm/slub.c:5658 mm/slub.c:5669)
>> [   81.189018][  T830]  sk_prot_alloc (./include/linux/slab.h:961 net/core/sock.c:2245)
>> [   81.189420][  T830]  sk_alloc (net/core/sock.c:2301)
>> [   81.189779][  T830]  nfc_llcp_sock_alloc (net/nfc/llcp_sock.c:979)
>> [   81.190222][  T830]  nfc_llcp_rx_skb (net/nfc/llcp_core.c:971 net/nfc/llcp_core.c:1478)
>> [   81.190656][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
>> [   81.193365][  T830] Freed by task 31 on cpu 196609 at 78.490492s:
>> [   81.195183][  T830]  kfree (mm/slub.c:6670 mm/slub.c:6878)
>> [   81.195531][  T830]  __sk_destruct (net/core/sock.c:2285 net/core/sock.c:2384)
>> [   81.195937][  T830]  nfc_llcp_rx_skb (.net/sock.h:? net/nfc/llcp_core.c:233 net/nfc/llcp_core.c:1194 net/nfc/llcp_core.c:1483)
>> [   81.196379][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
>> [   81.199084][  T830] The buggy address belongs to the object at ffff888119369800
>> [   81.199084][  T830]  which belongs to the cache kmalloc-1k of size 1024
>> [   81.200297][  T830] The buggy address is located 18 bytes inside of
>> [   81.200297][  T830]  freed 1024-byte region [ffff888119369800, ffff888119369c00)
>> 
>> 
>> Best,
>> Shuangpeng