Re: [BUG] nfc: KASAN: slab-use-after-free in nfc_llcp_rx_skb

On Wed, Aug 19, 2026 at 2:21 AM Shuangpeng Bai
<[email protected]> wrote:
>
> Hi Kernel Maintainers,
>
> I hit the following report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in nfc_llcp_rx_skb
>
> on commit: 3609fa95fb0f2c1b099e69e56634edb8fc03f87c (2026-01-04)

Are you sure this was not already fixed by 2b5dd4632966
("nfc: llcp: add missing return after LLCP_CLOSED checks") ?

>
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/70e3bdc241dbd675970fe89f30f0b84e
>
> I'm happy to test debug patches or provide additional information.
>
> Reported-by: Shuangpeng Bai <[email protected]>
>
> Decoded source path:
>
> use: net/nfc/llcp_core.c:1185 in nfc_llcp_recv_disc(), reading sk->sk_state
>      after nfc_llcp_sock_put() at line 1182; DISC dispatch is called from
>      net/nfc/llcp_core.c:1483 in nfc_llcp_rx_skb().
> free: concurrent socket release drops the final reference through
>       net/nfc/llcp_sock.c:646 sock_put(), then sk_free() releases the same
>       struct nfc_llcp_sock allocation.
>
> [   81.172360][  T830] BUG: KASAN: slab-use-after-free in nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
> [   81.173044][  T830] Read of size 1 at addr ffff888119369812 by task kworker/1:2/830
> [   81.173940][  T830] Tainted: [B]=BAD_PAGE, [W]=WARN
> [   81.173941][  T830] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   81.173943][  T830] Workqueue: events nfc_llcp_rx_work
> [   81.173946][  T830] Call Trace:
> [   81.173947][  T830]  <TASK>
> [   81.173952][  T830]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> [   81.173959][  T830]  kasan_report (mm/kasan/report.c:597)
> [   81.173965][  T830]  nfc_llcp_rx_skb (net/nfc/llcp_core.c:? net/nfc/llcp_core.c:1483)
> [   81.173973][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
> [   81.173976][  T830]  process_scheduled_works (kernel/workqueue.c:3262 kernel/workqueue.c:3340)
> [   81.173980][  T830]  worker_thread (./include/linux/list.h:381 kernel/workqueue.c:946 kernel/workqueue.c:3422)
> [   81.173984][  T830]  kthread (kernel/kthread.c:465)
> [   81.174000][  T830]  ret_from_fork (archkernel/process.c:164)
> [   81.174011][  T830]  ret_from_fork_asm (arch/x86/entry/entry_64.S:256)
> [   81.174014][  T830]  </TASK>
> [   81.187221][  T830] Allocated by task 4409 on cpu 1 at 75.384100s:
> [   81.188593][  T830]  __kmalloc_noprof (mm/slub.c:5658 mm/slub.c:5669)
> [   81.189018][  T830]  sk_prot_alloc (./include/linux/slab.h:961 net/core/sock.c:2245)
> [   81.189420][  T830]  sk_alloc (net/core/sock.c:2301)
> [   81.189779][  T830]  nfc_llcp_sock_alloc (net/nfc/llcp_sock.c:979)
> [   81.190222][  T830]  nfc_llcp_rx_skb (net/nfc/llcp_core.c:971 net/nfc/llcp_core.c:1478)
> [   81.190656][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
> [   81.193365][  T830] Freed by task 31 on cpu 196609 at 78.490492s:
> [   81.195183][  T830]  kfree (mm/slub.c:6670 mm/slub.c:6878)
> [   81.195531][  T830]  __sk_destruct (net/core/sock.c:2285 net/core/sock.c:2384)
> [   81.195937][  T830]  nfc_llcp_rx_skb (.net/sock.h:? net/nfc/llcp_core.c:233 net/nfc/llcp_core.c:1194 net/nfc/llcp_core.c:1483)
> [   81.196379][  T830]  nfc_llcp_rx_work (net/nfc/llcp_core.c:1533)
> [   81.199084][  T830] The buggy address belongs to the object at ffff888119369800
> [   81.199084][  T830]  which belongs to the cache kmalloc-1k of size 1024
> [   81.200297][  T830] The buggy address is located 18 bytes inside of
> [   81.200297][  T830]  freed 1024-byte region [ffff888119369800, ffff888119369c00)
>
>
> Best,
> Shuangpeng