Re: [BUG] KASAN: slab-use-after-free Read in slip_receive_buf

[Qingfang Deng]

On 2026/8/26 13:46, Eric Dumazet wrote:
> On Wed, Aug 26, 2026 at 7:38 AM Qingfang Deng <qingfang.deng@xxxxxxxxx> wrote:
> > Hi,
> >
> > On 2026/8/25 23:27, Eric Dumazet wrote:
> > > This rings a bell; I had a local syzbot report for this issue a while back.
> > >
> > > I think we should remove slip_hangup().
> > ppp_async.c and ppp_synctty.c have the same anti-pattern. Should we
> > remove theirs as well?
> Probably, akthough ppp_async and ppp_synctty historically suffered
> from this exact race, they added their own workaround: a global disc_data_lock,
> refcount_t refcnt, and wait_for_completion(&ap->dead) on every callback.
>
> Oh well.

Then the workaround should also be removed, according to the FIXME.

Relavent syzbot report:
https://lore.kernel.org/all/000000000000e8231f0601095c8e@xxxxxxxxxx/