[syzbot] [net?] KASAN: slab-use-after-free Read in sock_def_readable (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 6de23f81a5e0 Linux 7.0-rc1
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=148d655a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3b4642149033fe7c
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1085e55a580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e6d9e6580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-6de23f81.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5258f38d5768/vmlinux-6de23f81.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a7730b97aa5a/bzImage-6de23f81.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f50072...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in wq_has_sleeper include/linux/wait.h:161 [inline]
BUG: KASAN: slab-use-after-free in skwq_has_sleeper include/net/sock.h:2404 [inline]
BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
Read of size 8 at addr ffff888047cb0c00 by task kworker/0:4/5308

CPU: 0 UID: 0 PID: 5308 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: mld mld_ifc_work
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
waitqueue_active include/linux/wait.h:127 [inline]
wq_has_sleeper include/linux/wait.h:161 [inline]
skwq_has_sleeper include/net/sock.h:2404 [inline]
sock_def_readable+0x1cb/0x580 net/core/sock.c:3610
send_to_lecd+0x322/0x600 net/atm/lec.c:538
lec_arp_resolve net/atm/lec.c:1787 [inline]
lec_start_xmit+0xec0/0x2660 net/atm/lec.c:285
__netdev_start_xmit include/linux/netdevice.h:5275 [inline]
netdev_start_xmit include/linux/netdevice.h:5284 [inline]
xmit_one net/core/dev.c:3871 [inline]
dev_hard_start_xmit+0x2d8/0x870 net/core/dev.c:3887
sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347
__dev_xmit_skb net/core/dev.c:4186 [inline]
__dev_queue_xmit+0x1538/0x38a0 net/core/dev.c:4802
__ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
ip6_finish_output+0x25c/0x610 net/ipv6/ip6_output.c:219
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip6_output+0x340/0x550 net/ipv6/ip6_output.c:246
NF_HOOK+0xa2/0x3a0 include/linux/netfilter.h:318
mld_sendpack+0x8b4/0xe40 net/ipv6/mcast.c:1855
mld_send_cr net/ipv6/mcast.c:2154 [inline]
mld_ifc_work+0x835/0xe70 net/ipv6/mcast.c:2693
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>

Allocated by task 6850:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4849
sock_alloc_inode+0x28/0xc0 net/socket.c:322
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:637 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1569
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xd6/0x1b0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6859:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2687 [inline]
slab_free mm/slub.c:6124 [inline]
kmem_cache_free+0x187/0x630 mm/slub.c:6254
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3131 [inline]
call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
destroy_inode fs/inode.c:402 [inline]
evict+0x95b/0xb10 fs/inode.c:870
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
__fput+0x691/0xa70 fs/file_table.c:477
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888047cb0b80
which belongs to the cache sock_inode_cache of size 1344
The buggy address is located 128 bytes inside of
freed 1344-byte region [ffff888047cb0b80, ffff888047cb10c0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x47cb0
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888038584a01
flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000040 ffff888030419c80 dead000000000100 dead000000000122
raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff888038584a01
head: 04fff00000000040 ffff888030419c80 dead000000000100 dead000000000122
head: 0000000000000000 00000008000b000b 00000000f5000000 ffff888038584a01
head: 04fff00000000002 ffffea00011f2c01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5295, tgid 5295 (syz-execprog), ts 87351971632, free_ts 76295178870
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3255 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3444
new_slab mm/slub.c:3502 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7134
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x2b9/0x620 mm/slub.c:4578
alloc_from_pcs mm/slub.c:4681 [inline]
slab_alloc_node mm/slub.c:4815 [inline]
kmem_cache_alloc_lru_noprof+0x37c/0x640 mm/slub.c:4849
sock_alloc_inode+0x28/0xc0 net/socket.c:322
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:637 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1569
mptcp_subflow_create_socket+0xfb/0x800 net/mptcp/subflow.c:1788
__mptcp_socket_create net/mptcp/protocol.c:110 [inline]
__mptcp_nmpc_sk+0x155/0x790 net/mptcp/protocol.c:142
mptcp_setsockopt_v6 net/mptcp/sockopt.c:399 [inline]
mptcp_setsockopt+0xe4a/0x36a0 net/mptcp/sockopt.c:922
do_sock_setsockopt+0x270/0x400 net/socket.c:2322
__sys_setsockopt net/socket.c:2347 [inline]
__do_sys_setsockopt net/socket.c:2353 [inline]
__se_sys_setsockopt net/socket.c:2350 [inline]
__x64_sys_setsockopt+0x18a/0x210 net/socket.c:2350
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
page last free pid 5281 tgid 5281 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
__slab_free+0x263/0x2b0 mm/slub.c:5532
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
__kmalloc_cache_noprof+0x2ba/0x660 mm/slub.c:5334
kmalloc_noprof include/linux/slab.h:962 [inline]
tomoyo_print_header security/tomoyo/audit.c:156 [inline]
tomoyo_init_log+0x195/0x1fb0 security/tomoyo/audit.c:255
tomoyo_supervisor+0x353/0x1570 security/tomoyo/common.c:2232
tomoyo_audit_env_log security/tomoyo/environ.c:37 [inline]
tomoyo_env_perm+0x151/0x1f0 security/tomoyo/environ.c:64
tomoyo_environ security/tomoyo/domain.c:673 [inline]
tomoyo_find_next_domain+0x15cb/0x1aa0 security/tomoyo/domain.c:889
tomoyo_bprm_check_security+0x11b/0x180 security/tomoyo/tomoyo.c:102
security_bprm_check+0x85/0x240 security/security.c:794
search_binary_handler fs/exec.c:1654 [inline]
exec_binprm fs/exec.c:1696 [inline]
bprm_execve+0x896/0x1460 fs/exec.c:1748
do_execveat_common+0x50d/0x690 fs/exec.c:1846
__do_sys_execve fs/exec.c:1930 [inline]
__se_sys_execve fs/exec.c:1924 [inline]
__x64_sys_execve+0x97/0xc0 fs/exec.c:1924
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94

Memory state around the buggy address:
ffff888047cb0b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888047cb0b80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888047cb0c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888047cb0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888047cb0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] atm: lec: fix use-after-free in send_to_lecd
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

In send_to_lecd(), the socket is extracted via sk_atm(priv->lecd)
without holding a reference. The APIC timer triggers a softirq which
runs RCU callbacks, and if the RCU grace period has elapsed, the socket
can be freed via rcu_do_batch() while send_to_lecd() is still accessing
it, triggering a use-after-free bug.

Fix this by adding sock_hold() before accessing the socket and
sock_put() after all usage is done to prevent premature freeing.

Reported-by: syzbot+f50072...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
net/atm/lec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..4e752b4b623e 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -534,9 +534,9 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,

atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);
-
if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
atm_force_charge(priv->lecd, data->truesize);
@@ -544,6 +544,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
sk->sk_data_ready(sk);
}

+ sock_put(sk);
return 0;
}

--
2.43.0

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine



syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x15e000)
[ 97.361247][ T1361] cfg80211: failed to load regulatory.db
Warning: Permanently added '[localhost]:63864' (ED25519) to the list of known hosts.
2026/03/09 05:12:51 parsed 1 programs
[ 105.505495][ T5312] cgroup: Unknown subsys name 'net'
[ 105.556579][ T5312] cgroup: Unknown subsys name 'cpuset'
[ 105.564965][ T5312] cgroup: Unknown subsys name 'rlimit'
[ 143.435346][ T1314] ieee802154 phy0 wpan0: encryption failed: -22
[ 143.438624][ T1314] ieee802154 phy1 wpan1: encryption failed: -22
[ 156.251964][ T1010] ata1.00: NCQ disabled due to excessive errors
[ 156.255266][ T1010] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[ 156.259683][ T1010] ata1.00: failed command: WRITE FPDMA QUEUED
[ 156.263482][ T1010] ata1.00: cmd 61/f0:70:0e:cb:04/0a:00:00:00:00/40 tag 14 ncq dma 1433600 ou
[ 156.263482][ T1010] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 156.272729][ T1010] ata1.00: status: { DRDY }
[ 156.274976][ T1010] ata1: hard resetting link
[ 156.595684][ T1010] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 156.600550][ T1010] ata1.00: configured for UDMA/100
[ 156.603826][ T1010] ata1: EH complete
qemu-system-x86_64: hw/ide/core.c:934: ide_dma_cb: Assertion `prep_size >= 0 && prep_size <= n * 512' failed.
Connection to localhost closed by remote host.


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build951511429=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 7c9658af8505
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=7c9658af8505abccd5bf5890cc8a8e6d9826eaa0 -X github.com/google/syzkaller/prog.gitRevisionDate=20260223-092328" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"7c9658af8505abccd5bf5890cc8a8e6d9826eaa0\"
/usr/bin/ld: /tmp/ccKv8fCF.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb

dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17ad875a580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: Re: [PATCH] atm: lec: fix use-after-free in send_to_lecd

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in sock_def_readable

==================================================================
BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:381 [inline]
BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline]
BUG: KASAN: slab-use-after-free in wq_has_sleeper include/linux/wait.h:161 [inline]
BUG: KASAN: slab-use-after-free in skwq_has_sleeper include/net/sock.h:2404 [inline]
BUG: KASAN: slab-use-after-free in sock_def_readable+0x1cb/0x580 net/core/sock.c:3610

Read of size 8 at addr ffff888011ead1c0 by task dhcpcd/5015

CPU: 0 UID: 0 PID: 5015 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
list_empty include/linux/list.h:381 [inline]
waitqueue_active include/linux/wait.h:127 [inline]
wq_has_sleeper include/linux/wait.h:161 [inline]
skwq_has_sleeper include/net/sock.h:2404 [inline]
sock_def_readable+0x1cb/0x580 net/core/sock.c:3610

send_to_lecd+0x353/0x690 net/atm/lec.c:539
lec_arp_resolve net/atm/lec.c:1792 [inline]
lec_start_xmit+0xec0/0x2660 net/atm/lec.c:285
__netdev_start_xmit include/linux/netdevice.h:5292 [inline]
netdev_start_xmit include/linux/netdevice.h:5301 [inline]

xmit_one net/core/dev.c:3871 [inline]
dev_hard_start_xmit+0x2d8/0x870 net/core/dev.c:3887
sch_direct_xmit+0x251/0x4c0 net/sched/sch_generic.c:347
__dev_xmit_skb net/core/dev.c:4186 [inline]

__dev_queue_xmit+0x1550/0x3890 net/core/dev.c:4802
lapb_data_transmit+0x90/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
lapb_establish_data_link+0x89/0xe0 net/lapb/lapb_out.c:-1
lapb_device_event+0x4e1/0x670 net/lapb/lapb_iface.c:-1
notifier_call_chain+0x1be/0x400 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]
call_netdevice_notifiers net/core/dev.c:2301 [inline]
__dev_notify_flags+0x1a9/0x310 net/core/dev.c:9803
netif_change_flags+0xe8/0x1a0 net/core/dev.c:9832
dev_change_flags+0x130/0x260 net/core/dev_api.c:68
devinet_ioctl+0x9f2/0x1b30 net/ipv4/devinet.c:1199
inet_ioctl+0x42a/0x560 net/ipv4/af_inet.c:1009
sock_do_ioctl+0x101/0x320 net/socket.c:1254
sock_ioctl+0x5c6/0x7f0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f0bc372b378
Code: 00 00 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 10 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 07 89 d0 c3 0f 1f 40 00 48 8b 15 49 3a 0d
RSP: 002b:00007fff9b806dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000018 RCX: 00007f0bc372b378
RDX: 00007fff9b816fc0 RSI: 0000000000008914 RDI: 0000000000000018
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff9b827160
R13: 00007f0bc362b708 R14: 0000000000000028 R15: 0000000000008914
</TASK>

Allocated by task 5796:

kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]

slab_post_alloc_hook mm/slub.c:4542 [inline]
slab_alloc_node mm/slub.c:4869 [inline]
kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4888

sock_alloc_inode+0x28/0xc0 net/socket.c:322
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:637 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1569
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xd6/0x1b0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15:

kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]

slab_free_hook mm/slub.c:2692 [inline]
slab_free mm/slub.c:6168 [inline]
kmem_cache_free+0x187/0x630 mm/slub.c:6298

rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869
handle_softirqs+0x22a/0x870 kernel/softirq.c:622

run_ksoftirqd+0x36/0x60 kernel/softirq.c:1063
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436

ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3131 [inline]
call_rcu+0xee/0x890 kernel/rcu/tree.c:3251
destroy_inode fs/inode.c:402 [inline]
evict+0x95b/0xb10 fs/inode.c:870
__dentry_kill+0x1a2/0x5e0 fs/dcache.c:670
finish_dput+0xc9/0x480 fs/dcache.c:879
__fput+0x691/0xa70 fs/file_table.c:477
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888011ead140

which belongs to the cache sock_inode_cache of size 1344
The buggy address is located 128 bytes inside of

freed 1344-byte region [ffff888011ead140, ffff888011ead680)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11eac

head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0

memcg:ffff888043587181
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b7b0140 dead000000000100 dead000000000122
raw: 0000000000000000 00000008000b000b 00000000f5000000 ffff888043587181
head: 00fff00000000040 ffff88801b7b0140 dead000000000100 dead000000000122
head: 0000000000000000 00000008000b000b 00000000f5000000 ffff888043587181
head: 00fff00000000002 ffffea000047ab01 00000000ffffffff 00000000ffffffff

head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 2, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5302, tgid 5302 (sshd-session), ts 94001934717, free_ts 93590589059

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250

alloc_slab_page mm/slub.c:3296 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3485
new_slab mm/slub.c:3543 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7178
__pcs_replace_empty_main+0x2f9/0x5e0 mm/slub.c:-1
alloc_from_pcs mm/slub.c:4720 [inline]
slab_alloc_node mm/slub.c:4854 [inline]
kmem_cache_alloc_lru_noprof+0x37c/0x640 mm/slub.c:4888

sock_alloc_inode+0x28/0xc0 net/socket.c:322
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:637 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1569
sock_create net/socket.c:1663 [inline]
__sys_socket_create net/socket.c:1700 [inline]
__sys_socket+0xd6/0x1b0 net/socket.c:1747
__do_sys_socket net/socket.c:1761 [inline]
__se_sys_socket net/socket.c:1759 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1759
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

page last free pid 5297 tgid 5297 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]

free_unref_folios+0xed5/0x16d0 mm/page_alloc.c:3040
folios_put_refs+0x789/0x8d0 mm/swap.c:1002
free_pages_and_swap_cache+0x2e7/0x5b0 mm/swap_state.c:423
__tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:405
tlb_finish_mmu+0xf9/0x230 mm/mmu_gather.c:530
unmap_region+0x2a5/0x330 mm/vma.c:488
vms_clear_ptes mm/vma.c:1284 [inline]
vms_complete_munmap_vmas+0x493/0xc60 mm/vma.c:1326
do_vmi_align_munmap+0x3b7/0x4b0 mm/vma.c:1585
do_vmi_munmap+0x252/0x2d0 mm/vma.c:1633
__vm_munmap+0x22c/0x3d0 mm/vma.c:3254
__do_sys_munmap mm/mmap.c:1078 [inline]
__se_sys_munmap mm/mmap.c:1075 [inline]
__x64_sys_munmap+0x60/0x70 mm/mmap.c:1075

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:

ffff888011ead080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888011ead100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888011ead180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888011ead200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888011ead280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=123f0d52580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=12d228ba580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()

Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

A race condition exists between lec_atm_close() setting priv->lecd = NULL
and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(),
and lec_atm_send(). When the socket is freed via RCU while another thread
is still using it, a use-after-free occurs in sock_def_readable() when
accessing the socket's wait queue.

The root cause is that lec_atm_close() clears priv->lecd without holding
lec_arp_lock, while callers dereference priv->lecd without any protection
against concurrent teardown.

Fix this by:
- Protecting priv->lecd = NULL in lec_atm_close() with lec_arp_lock to
synchronize with callers that already hold the lock (e.g. lec_arp_resolve)
- Using sock_hold/sock_put in send_to_lecd() to pin the socket while in
use. This is safe because send_to_lecd() is called under lec_arp_lock
by lec_arp_resolve(), preventing concurrent NULL assignment of lecd.
- Using lec_arp_lock + sock_hold/sock_put in lec_handle_bridge() and
lec_atm_send() where the lock is not held by the caller, with proper
skb cleanup on early exit to avoid memory leaks.

Reported-by: syzbot+f50072...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---

net/atm/lec.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..7e051174a92b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -131,6 +131,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
{
char *buff;
struct lec_priv *priv;
+ unsigned long flags;

/*
* Check if this is a BPDU. If so, ask zeppelin to send
@@ -154,10 +155,19 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
/* 0x01 is topology change */

priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ return;
+ }

sk = sk_atm(priv->lecd);
+ sock_hold(sk);

+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -441,7 +451,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;
struct sock *sk;
-
+ unsigned long flags;
pr_debug("%s: entry found, responding to zeppelin\n",
dev->name);
skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
@@ -449,10 +459,19 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
+ if (!priv->lecd) {
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ kfree_skb(skb2);
+ break;
+ }

sk = sk_atm(priv->lecd);
+ sock_hold(sk);

+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+ atm_force_charge(priv->lecd, skb2->truesize);
skb_queue_tail(&sk->sk_receive_queue, skb2);
sk->sk_data_ready(sk);
+ sock_put(sk);
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -471,8 +490,11 @@ static void lec_atm_close(struct atm_vcc *vcc)
struct sk_buff *skb;
struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);
+ unsigned long flags;

+ spin_lock_irqsave(&priv->lec_arp_lock, flags);
priv->lecd = NULL;
+ spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
/* Do something needful? */

netif_stop_queue(dev);
@@ -534,6 +556,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,

atm_force_charge(priv->lecd, skb->truesize);
sk = sk_atm(priv->lecd);
+ sock_hold(sk);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);

@@ -543,7 +566,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}
-

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

lost connection to test machine

Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=14ea28ba580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=122d03aa580000

[syzbot]

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine

qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
Warning: Permanently added '[localhost]:8651' (ED25519) to the list of known hosts.
2026/03/09 07:34:15 parsed 1 programs
[ 61.038498][ T5297] cgroup: Unknown subsys name 'net'
[ 61.082207][ T5297] cgroup: Unknown subsys name 'cpuset'
[ 61.085713][ T5297] cgroup: Unknown subsys name 'rlimit'
[ 76.021725][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[ 76.024057][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[ 86.265587][ T1360] cfg80211: failed to load regulatory.db
[ 118.279844][ T1009] ata1.00: exception Emask 0x0 SAct 0x4000 SErr 0x0 action 0x6 frozen
[ 118.282758][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.284895][ T1009] ata1.00: cmd 61/00:70:36:81:04/20:00:00:00:00/40 tag 14 ncq dma 4194304 ou
[ 118.284895][ T1009] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 118.290867][ T1009] ata1.00: status: { DRDY }
[ 118.292518][ T1009] ata1: hard resetting link
[ 118.613228][ T1009] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 118.617551][ T1009] ata1.00: configured for UDMA/100
[ 118.619916][ T1009] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 118.640373][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 118.642754][ T1009] ata1: failed to read log page 10h (errno=-5)
[ 118.645021][ T1009] ata1.00: exception Emask 0x1 SAct 0x7c SErr 0x0 action 0x0
[ 118.647590][ T1009] ata1.00: irq_stat 0x41000000
[ 118.649279][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.651718][ T1009] ata1.00: cmd 61/00:10:5e:12:05/20:00:00:00:00/40 tag 2 ncq dma 4194304 ou
[ 118.651718][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.657603][ T1009] ata1.00: status: { DRDY }
[ 118.659224][ T1009] ata1.00: error: { ABRT }
[ 118.661112][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.663256][ T1009] ata1.00: cmd 61/d8:18:5e:32:05/0e:00:00:00:00/40 tag 3 ncq dma 1945600 ou
[ 118.663256][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.669137][ T1009] ata1.00: status: { DRDY }
[ 118.670973][ T1009] ata1.00: error: { ABRT }
[ 118.672562][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.674666][ T1009] ata1.00: cmd 61/60:20:36:41:05/05:00:00:00:00/40 tag 4 ncq dma 704512 out
[ 118.674666][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.680766][ T1009] ata1.00: status: { DRDY }
[ 118.682372][ T1009] ata1.00: error: { ABRT }
[ 118.683945][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.686052][ T1009] ata1.00: cmd 61/00:28:96:46:05/20:00:00:00:00/40 tag 5 ncq dma 4194304 ou
[ 118.686052][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.692196][ T1009] ata1.00: status: { DRDY }
[ 118.693803][ T1009] ata1.00: error: { ABRT }
[ 118.695419][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.697514][ T1009] ata1.00: cmd 61/a0:30:96:66:05/1a:00:00:00:00/40 tag 6 ncq dma 3489792 ou
[ 118.697514][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.703662][ T1009] ata1.00: status: { DRDY }
[ 118.705269][ T1009] ata1.00: error: { ABRT }
[ 118.707646][ T1009] ata1.00: configured for UDMA/100
[ 118.710038][ T1009] ata1: EH complete
qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
[ 118.753868][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 118.756214][ T1009] ata1: failed to read log page 10h (errno=-5)
[ 118.758355][ T1009] ata1.00: NCQ disabled due to excessive errors
[ 118.770980][ T1009] ata1.00: exception Emask 0x1 SAct 0x1800 SErr 0x0 action 0x0
[ 118.773616][ T1009] ata1.00: irq_stat 0x41000008
[ 118.775342][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.777442][ T1009] ata1.00: cmd 61/00:58:36:81:04/20:00:00:00:00/40 tag 11 ncq dma 4194304 ou
[ 118.777442][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.800358][ T1009] ata1.00: status: { DRDY }
[ 118.802026][ T1009] ata1.00: error: { ABRT }
[ 118.803601][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 118.805715][ T1009] ata1.00: cmd 61/00:60:5e:12:05/20:00:00:00:00/40 tag 12 ncq dma 4194304 ou
[ 118.805715][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 118.815619][ T1009] ata1.00: status: { DRDY }
[ 118.817308][ T1009] ata1.00: error: { ABRT }
[ 118.819854][ T1009] ata1.00: configured for UDMA/100
[ 118.821947][ T1009] ata1: EH complete

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2930426070=/tmp/go-build -gno-record-gcc-switches'

/usr/bin/ld: /tmp/cckeeX7G.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null

Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=15a98016580000

[syzbot]

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

lost connection to test machine

syzkaller login: qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)
Warning: Permanently added '[localhost]:61150' (ED25519) to the list of known hosts.
2026/03/09 08:11:07 parsed 1 programs
[ 100.778155][ T5308] cgroup: Unknown subsys name 'net'
[ 100.824718][ T5308] cgroup: Unknown subsys name 'cpuset'
[ 100.835966][ T5308] cgroup: Unknown subsys name 'rlimit'
[ 102.495043][ T9] cfg80211: failed to load regulatory.db
[ 143.453170][ T1316] ieee802154 phy0 wpan0: encryption failed: -22
[ 143.456980][ T1316] ieee802154 phy1 wpan1: encryption failed: -22
[ 151.790041][ T1009] ata1.00: exception Emask 0x0 SAct 0x200000 SErr 0x0 action 0x6 frozen
[ 151.795444][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 151.798620][ T1009] ata1.00: cmd 61/00:a8:36:c1:04/20:00:00:00:00/40 tag 21 ncq dma 4194304 ou
[ 151.798620][ T1009] res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
[ 151.807230][ T1009] ata1.00: status: { DRDY }
[ 151.810358][ T1009] ata1: hard resetting link
[ 152.133478][ T1009] ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
[ 152.138661][ T1009] ata1.00: configured for UDMA/100
[ 152.142424][ T1009] ata1: EH complete

qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)

[ 152.180979][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 152.184589][ T1009] ata1: failed to read log page 10h (errno=-5)
[ 152.187583][ T1009] ata1.00: exception Emask 0x1 SAct 0x76 SErr 0x0 action 0x0
[ 152.200268][ T1009] ata1.00: irq_stat 0x41000000
[ 152.202658][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 152.205600][ T1009] ata1.00: cmd 61/00:08:36:c1:04/20:00:00:00:00/40 tag 1 ncq dma 4194304 ou
[ 152.205600][ T1009] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 152.233239][ T1009] ata1.00: status: { DRDY }
[ 152.240616][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 152.243710][ T1009] ata1.00: cmd 61/08:10:4e:04:10/00:00:00:00:00/40 tag 2 ncq dma 4096 out
[ 152.243710][ T1009] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 152.257043][ T1009] ata1.00: status: { DRDY }
[ 152.260632][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 152.263657][ T1009] ata1.00: cmd 61/00:20:36:01:05/20:00:00:00:00/40 tag 4 ncq dma 4194304 ou
[ 152.263657][ T1009] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 152.272096][ T1009] ata1.00: status: { DRDY }
[ 152.274461][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 152.277407][ T1009] ata1.00: cmd 61/00:28:36:21:05/20:00:00:00:00/40 tag 5 ncq dma 4194304 ou
[ 152.277407][ T1009] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 152.286072][ T1009] ata1.00: status: { DRDY }
[ 152.288291][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 152.291815][ T1009] ata1.00: cmd 61/f8:30:36:41:05/0b:00:00:00:00/40 tag 6 ncq dma 1568768 ou
[ 152.291815][ T1009] res 50/00:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 152.300643][ T1009] ata1.00: status: { DRDY }
[ 152.304040][ T1009] ata1.00: configured for UDMA/100
[ 152.307255][ T1009] ata1: EH complete

qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000)

[ 152.331089][ T1009] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1
[ 152.334242][ T1009] ata1: failed to read log page 10h (errno=-5)
[ 152.337932][ T1009] ata1.00: NCQ disabled due to excessive errors
[ 152.341762][ T1009] ata1.00: exception Emask 0x1 SAct 0x800 SErr 0x0 action 0x0
[ 152.345331][ T1009] ata1.00: irq_stat 0x41000008
[ 152.347892][ T1009] ata1.00: failed command: WRITE FPDMA QUEUED
[ 152.351796][ T1009] ata1.00: cmd 61/00:58:36:c1:04/20:00:00:00:00/40 tag 11 ncq dma 4194304 ou
[ 152.351796][ T1009] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error)
[ 152.361851][ T1009] ata1.00: status: { DRDY }
[ 152.364344][ T1009] ata1.00: error: { ABRT }
[ 152.367708][ T1009] ata1.00: configured for UDMA/100
[ 152.372040][ T1009] ata1: EH complete
Setting up swapspace version 1, size = 127995904 bytes
[ 154.342839][ T5308] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build997279610=/tmp/go-build -gno-record-gcc-switches'

/usr/bin/ld: /tmp/ccdnCVXi.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null



Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=108a4806580000

[syzbot]

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

lost connection to test machine

Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=17aa894a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=16fbaa02580000

[Jiayuan Chen]

#syz test

diff --git a/net/atm/lec.c b/net/atm/lec.c
index 7e6fc2bd40ac..7d99ba8ba3b4 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -139,6 +139,7 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
*/
buff = skb->data + skb->dev->hard_header_len;
if (*buff++ == 0x42 && *buff++ == 0x42 && *buff++ == 0x03) {
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb2;
struct atmlec_msg *mesg;
@@ -154,10 +155,18 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)

/* 0x01 is topology change */

priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);

- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -216,7 +225,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
int is_rdesc;

pr_debug("called\n");
- if (!priv->lecd) {
+ if (!rcu_access_pointer(priv->lecd)) {
pr_info("%s:No lecd attached\n", dev->name);
dev->stats.tx_errors++;
netif_stop_queue(dev);
@@ -440,6 +449,7 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
if (br_fdb_test_addr_hook(dev, mesg->content.proxy.mac_addr)) {

/* hit from bridge table, send LE_ARP_RESPONSE */
struct sk_buff *skb2;

+ struct atm_vcc *lecd;
struct sock *sk;

pr_debug("%s: entry found, responding to zeppelin\n",

@@ -449,10 +459,18 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)

break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);

- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);
+
+ rcu_read_lock();
+ lecd = rcu_dereference(priv->lecd);
+ if (lecd) {
+ atm_force_charge(lecd, skb2->truesize);
+ sk = sk_atm(lecd);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */
@@ -472,7 +490,8 @@ static void lec_atm_close(struct atm_vcc *vcc)

struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);

- priv->lecd = NULL;
+ rcu_assign_pointer(priv->lecd, NULL);
+ synchronize_rcu();

/* Do something needful? */

netif_stop_queue(dev);

@@ -510,15 +529,25 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
const unsigned char *mac_addr, const unsigned char *atm_addr,
struct sk_buff *data)
{
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb;
struct atmlec_msg *mesg;

- if (!priv || !priv->lecd)
+ if (!priv)
+ return -1;
+
+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (!vcc) {
+ rcu_read_unlock();
return -1;
+ }
skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
- if (!skb)
+ if (!skb) {
+ rcu_read_unlock();
return -1;
+ }
skb->len = sizeof(struct atmlec_msg);
mesg = (struct atmlec_msg *)skb->data;
memset(mesg, 0, sizeof(struct atmlec_msg));
@@ -532,18 +561,19 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
if (atm_addr)
memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);

- atm_force_charge(priv->lecd, skb->truesize);
- sk = sk_atm(priv->lecd);
+ atm_force_charge(vcc, skb->truesize);
+ sk = sk_atm(vcc);

skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);

if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);

- atm_force_charge(priv->lecd, data->truesize);
+ atm_force_charge(vcc, data->truesize);

skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}

+ rcu_read_unlock();
return 0;
}

@@ -618,7 +648,8 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)

atm_return(vcc, skb->truesize);
if (*(__be16 *) skb->data == htons(priv->lecid) ||
- !priv->lecd || !(dev->flags & IFF_UP)) {
+ !rcu_access_pointer(priv->lecd) ||
+ !(dev->flags & IFF_UP)) {
/*
* Probably looping back, or if lecd is missing,
* lecd has gone down
@@ -753,12 +784,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
priv = netdev_priv(dev_lec[i]);
} else {
priv = netdev_priv(dev_lec[i]);
- if (priv->lecd)
+ if (rcu_access_pointer(priv->lecd))
return -EADDRINUSE;
}
lec_arp_init(priv);
priv->itfnum = i; /* LANE2 addition */
- priv->lecd = vcc;
+ rcu_assign_pointer(priv->lecd, vcc);
vcc->dev = &lecatm_dev;
vcc_insert_socket(sk_atm(vcc));

diff --git a/net/atm/lec.h b/net/atm/lec.h
index be0e2667bd8c..ec85709bf818 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -91,7 +91,7 @@ struct lec_priv {
*/
spinlock_t lec_arp_lock;
struct atm_vcc *mcast_vcc; /* Default Multicast Send VCC */
- struct atm_vcc *lecd;
+ struct atm_vcc __rcu *lecd;
struct delayed_work lec_arp_work; /* C10 */
unsigned int maximum_unknown_frame_count;
/*

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to copy syz-execprog to VM: failed to run ["scp" "-P" "48817" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "IdentitiesOnly=yes" "-o" "BatchMode=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/bin/linux_amd64/syz-execprog" "root@localhost:/syz-execprog"]: exit status 255

GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3224921581=/tmp/go-build -gno-record-gcc-switches'

/usr/bin/ld: /tmp/cc2JgryH.o: in function `Connection::Connect(char const*, char const*)':

executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null

Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=1528375a580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] atm: lec: fix use-after-free in sock_def_readable()
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


A race condition exists between lec_atm_close() setting priv->lecd

to NULL and concurrent access to priv->lecd in send_to_lecd(),

lec_handle_bridge(), and lec_atm_send(). When the socket is freed
via RCU while another thread is still using it, a use-after-free
occurs in sock_def_readable() when accessing the socket's wait queue.

The root cause is that lec_atm_close() clears priv->lecd without

any synchronization, while callers dereference priv->lecd without

any protection against concurrent teardown.

Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()
for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference
the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and
lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),
lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in
lec_atm_close() to ensure all readers have completed before
proceeding. This is safe since lec_atm_close() is called from
vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close()
since vcc_destroy_socket() already drains it after lec_atm_close()
returns.

v2: Switch from spinlock + sock_hold/put approach to RCU to properly
fix the race. The v1 spinlock approach had two issues pointed out
by Eric Dumazet:
1. priv->lecd was still accessed directly after releasing the
lock instead of using a local copy.
2. The spinlock did not prevent packets being queued after
lec_atm_close() drains sk_receive_queue since timer and
workqueue paths bypass netif_stop_queue().

Reported-by: syzbot+f50072...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925

Link: https://lore.kernel.org/all/20260309093614.50...@gmail.com/T/ [v1]

Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---

net/atm/lec.c | 70 +++++++++++++++++++++++++++++++++------------------
net/atm/lec.h | 2 +-
2 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/net/atm/lec.c b/net/atm/lec.c
index fb93c6e1c329..32adf28663a0 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -154,10 +154,18 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)

/* 0x01 is topology change */

priv = netdev_priv(dev);
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);

+ struct atm_vcc *vcc;

+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */

@@ -216,7 +224,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,

int is_rdesc;

pr_debug("called\n");
- if (!priv->lecd) {
+ if (!rcu_access_pointer(priv->lecd)) {
pr_info("%s:No lecd attached\n", dev->name);
dev->stats.tx_errors++;
netif_stop_queue(dev);

@@ -449,10 +457,18 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)

break;
skb2->len = sizeof(struct atmlec_msg);
skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
- atm_force_charge(priv->lecd, skb2->truesize);
- sk = sk_atm(priv->lecd);
- skb_queue_tail(&sk->sk_receive_queue, skb2);
- sk->sk_data_ready(sk);

+ struct atm_vcc *vcc;

+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (vcc) {
+ atm_force_charge(vcc, skb2->truesize);
+ sk = sk_atm(vcc);
+ skb_queue_tail(&sk->sk_receive_queue, skb2);
+ sk->sk_data_ready(sk);
+ } else {
+ dev_kfree_skb(skb2);
+ }
+ rcu_read_unlock();
}
}
#endif /* IS_ENABLED(CONFIG_BRIDGE) */

@@ -468,23 +484,16 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)

static void lec_atm_close(struct atm_vcc *vcc)

{
- struct sk_buff *skb;

struct net_device *dev = (struct net_device *)vcc->proto_data;
struct lec_priv *priv = netdev_priv(dev);

- priv->lecd = NULL;
+ rcu_assign_pointer(priv->lecd, NULL);
+ synchronize_rcu();
/* Do something needful? */

netif_stop_queue(dev);

lec_arp_destroy(priv);

- if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
- pr_info("%s closing with messages pending\n", dev->name);
- while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
- atm_return(vcc, skb->truesize);
- dev_kfree_skb(skb);
- }
-
pr_info("%s: Shut down!\n", dev->name);
module_put(THIS_MODULE);
}
@@ -510,12 +519,14 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,

const unsigned char *mac_addr, const unsigned char *atm_addr,
struct sk_buff *data)
{
+ struct atm_vcc *vcc;
struct sock *sk;
struct sk_buff *skb;
struct atmlec_msg *mesg;

- if (!priv || !priv->lecd)

+ if (!priv || !rcu_access_pointer(priv->lecd))

return -1;
+
skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);

if (!skb)
return -1;
@@ -532,18 +543,27 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,

if (atm_addr)
memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);

- atm_force_charge(priv->lecd, skb->truesize);
- sk = sk_atm(priv->lecd);

+ rcu_read_lock();
+ vcc = rcu_dereference(priv->lecd);
+ if (!vcc) {
+ rcu_read_unlock();

+ kfree_skb(skb);

+ return -1;
+ }
+

+ atm_force_charge(vcc, skb->truesize);
+ sk = sk_atm(vcc);
skb_queue_tail(&sk->sk_receive_queue, skb);
sk->sk_data_ready(sk);

if (data != NULL) {
pr_debug("about to send %d bytes of data\n", data->len);
- atm_force_charge(priv->lecd, data->truesize);
+ atm_force_charge(vcc, data->truesize);
skb_queue_tail(&sk->sk_receive_queue, data);
sk->sk_data_ready(sk);
}

+ rcu_read_unlock();
return 0;
}

@@ -618,7 +638,7 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)

atm_return(vcc, skb->truesize);
if (*(__be16 *) skb->data == htons(priv->lecid) ||
- !priv->lecd || !(dev->flags & IFF_UP)) {

+ !rcu_access_pointer(priv->lecd) || !(dev->flags & IFF_UP)) {

/*
* Probably looping back, or if lecd is missing,
* lecd has gone down

@@ -753,12 +773,12 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)

--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
lost connection to test machine

Tested on:

commit: 1f318b96 Linux 7.0-rc3
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=125e6016580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c5c49ee0942d1cdb
dashboard link: https://syzkaller.appspot.com/bug?extid=f50072212ab792c86925
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=13fc375a580000