Re: [BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[Shuangpeng]

> On Aug 19, 2026, at 03:48, Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
> 
> On Wed, Aug 19, 2026 at 7:00 AM Shuangpeng Bai
> <shuangpeng.kernel@xxxxxxxxx> wrote:
>> 
>> Hi Kernel Maintainers,
>> 
>> I hit the following report while testing current upstream kernel:
>> 
>> KASAN: slab-use-after-free in _raw_spin_lock_irqsave
>> 
>> on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)
>> 
>> To help trigger the bug more reliably, we applied a minimal diagnostic patch
>> that only adds delays and print statements.
>> 
>> The reproducer and .config files are here.
>> https://gist.github.com/shuangpengbai/f7dab4725e2a2d57b1d302714c93c549
>> 
>> I'm happy to test debug patches or provide additional information.
> 
> Thanks for the report, could you test adding one skb_set_owner_w()
> after the skb_copy() in nfc_llcp_tx_work() ?
> 
> Something like this (untested, not compiled) patch.

Thanks for your fix!

I tested the patch and reran the reproducer. The bug did not reappear.

> 
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index cac1b5487064d0c5b4966bb6a75aa26e67131049..49cb632268c0c2841e3b44dde124c7966267b709
> 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -786,8 +786,11 @@ static void nfc_llcp_tx_work(struct work_struct *work)
>                        print_hex_dump_debug("LLCP Tx: ", DUMP_PREFIX_OFFSET,
>                                             16, 1, skb->data, skb->len, true);
> 
> -                       if (ptype == LLCP_PDU_I)
> +                       if (ptype == LLCP_PDU_I) {
>                                copy_skb = skb_copy(skb, GFP_ATOMIC);
> +                               if (copy_skb)
> +                                       skb_set_owner_w(copy_skb, sk);
> +                       }
> 
>                        __net_timestamp(skb);