Re: [BUG] NFC: slab-use-after-free in _raw_spin_lock_irqsave

[Eric Dumazet]

On Fri, Aug 21, 2026 at 2:54 AM Shuangpeng <shuangpeng.kernel@xxxxxxxxx> wrote:
>
>
>
> > On Aug 19, 2026, at 03:48, Eric Dumazet <edumazet@xxxxxxxxxx> wrote:
> >
> > On Wed, Aug 19, 2026 at 7:00 AM Shuangpeng Bai
> > <shuangpeng.kernel@xxxxxxxxx> wrote:
> >>
> >> Hi Kernel Maintainers,
> >>
> >> I hit the following report while testing current upstream kernel:
> >>
> >> KASAN: slab-use-after-free in _raw_spin_lock_irqsave
> >>
> >> on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)
> >>
> >> To help trigger the bug more reliably, we applied a minimal diagnostic patch
> >> that only adds delays and print statements.
> >>
> >> The reproducer and .config files are here.
> >> https://gist.github.com/shuangpengbai/f7dab4725e2a2d57b1d302714c93c549
> >>
> >> I'm happy to test debug patches or provide additional information.
> >
> > Thanks for the report, could you test adding one skb_set_owner_w()
> > after the skb_copy() in nfc_llcp_tx_work() ?
> >
> > Something like this (untested, not compiled) patch.
>
> Thanks for your fix!
>
> I tested the patch and reran the reproducer. The bug did not reappear.

Great, I have sent a formal patch, please fell free to add a Tested-by: tag.

Thanks.