Re: [PATCH net] net/x25: fix use-after-free in x25_kill_by_neigh()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Mon, 13 Jul 2026 10:47:50 +0000 you wrote:
> x25_kill_by_neigh() walks the global X.25 socket list looking for sockets
> attached to a terminating neighbour. x25_list_lock protects list membership
> while the lookup is in progress, but it does not pin a socket's lifetime
> after the lock is dropped.
> 
> The function currently drops x25_list_lock before calling lock_sock(s). A
> concurrent close can run x25_release(), remove the same socket from
> x25_list, and drop the last socket reference in that window. The neighbour
> teardown path can then lock or inspect a freed struct sock/struct x25_sock.
> 
> [...]

Here is the summary with links:
  - [net] net/x25: fix use-after-free in x25_kill_by_neigh()
    https://git.kernel.org/netdev/net/c/5499e0602d2f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html