Re: [BUG] KASAN: slab-use-after-free Read in slip_receive_buf

[Eric Dumazet]

On Wed, Aug 26, 2026 at 7:53 AM Qingfang Deng <qingfang.deng@xxxxxxxxx> wrote:
>
> On 2026/8/26 13:46, Eric Dumazet wrote:
> > On Wed, Aug 26, 2026 at 7:38 AM Qingfang Deng <qingfang.deng@xxxxxxxxx> wrote:
> >> Hi,
> >>
> >> On 2026/8/25 23:27, Eric Dumazet wrote:
> >>> This rings a bell; I had a local syzbot report for this issue a while back.
> >>>
> >>> I think we should remove slip_hangup().
> >> ppp_async.c and ppp_synctty.c have the same anti-pattern. Should we
> >> remove theirs as well?
> > Probably, akthough ppp_async and ppp_synctty historically suffered
> > from this exact race, they added their own workaround: a global disc_data_lock,
> > refcount_t refcnt, and wait_for_completion(&ap->dead) on every callback.
> >
> > Oh well.
>
> Then the workaround should also be removed, according to the FIXME.
>
> Relavent syzbot report:
> https://lore.kernel.org/all/000000000000e8231f0601095c8e@xxxxxxxxxx/
>

I can take care of slip_hanghup() removal, I will let you handle ppp :)