Re: [PATCH net] phonet: pep: fix use-after-free in pep_get_sb()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Tue, 21 Jul 2026 01:58:45 -0700 you wrote:
> pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
> the skb data, and continue to access the older pointer, causing UAF.
> 
> Reproduced under KASAN:
> 
>   BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
>   Read of size 1 at addr ff11000105510f50 by task repro/157
>    pep_get_sb+0x234/0x3b0
>    pipe_handler_do_rcv+0x5f7/0xa10
>    pep_do_rcv+0x203/0x410
>    __sk_receive_skb+0x471/0x4a0
>    phonet_rcv+0x5b3/0x6c0
>    __netif_receive_skb+0xcc/0x1d0
> 
> [...]

Here is the summary with links:
  - [net] phonet: pep: fix use-after-free in pep_get_sb()
    https://git.kernel.org/netdev/net/c/0f71f852a96a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html