Re: [syzbot] [x25?] possible deadlock in lapb_data_received
From: Hillf Danton
Date: Tue Oct 20 2026 - 00:29:38 EST
> Date: Mon, 19 Oct 2026 12:20:19 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 2c7935600733 Merge branch 'bpf-zero-extend-the-index-in-in..
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=13598f01580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=964a8fc052e56fe5
> dashboard link: https://syzkaller.appspot.com/bug?extid=059a2795ad4cff2a2695
> compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117c5031580000
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 70dd4ee72eb2
--- x/drivers/net/wan/lapbether.c
+++ y/drivers/net/wan/lapbether.c
@@ -139,7 +139,10 @@ static int lapbeth_rcv(struct sk_buff *s
skb_pull(skb, 2); /* Remove the length bytes */
skb_trim(skb, len); /* Set the length of the data */
+ /* still with rcu lock held */
+ spin_unlock_bh(&lapbeth->up_lock);
err = lapb_data_received(lapbeth->axdev, skb);
+ spin_lock_bh(&lapbeth->up_lock);
if (err != LAPB_OK) {
printk(KERN_DEBUG "lapbether: lapb_data_received err - %d\n", err);
goto drop_unlock;
@@ -343,6 +346,7 @@ static int lapbeth_close(struct net_devi
struct lapbethdev *lapbeth = netdev_priv(dev);
int err;
+ synchronize_rcu();
spin_lock_bh(&lapbeth->up_lock);
lapbeth->up = false;
spin_unlock_bh(&lapbeth->up_lock);
--