Re: [PATCH net v2] net/x25: fix use-after-free of the socket by its timers

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

On Mon, 27 Jul 2026 07:03:42 +0900 you wrote:
> The x25 timers are armed with mod_timer() and cancelled with
> timer_delete(), so a pending timer holds no reference on the socket and a
> cancel does not wait for a callback already running on another CPU.
> 
> x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall
> sk->sk_timer after __x25_destroy_socket() has passed its cancel point.
> The following __sock_put() frees the socket while the timer is still
> queued, and the next expiry uses freed memory.  KASAN reports a
> slab-use-after-free on the kmalloc-2k object freed by close().
> 
> [...]

Here is the summary with links:
  - [net,v2] net/x25: fix use-after-free of the socket by its timers
    https://git.kernel.org/netdev/net/c/2195424c3da2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html