Testing for netrom: fix KASAN slab-use-after-free in nr_dec_obs()

Posted by Prithvi Tambewagh 3 weeks ago

#syz test upstream be548645527a131a097fdc884b7fca40c8b86231

Signed-off-by: Prithvi Tambewagh <activprithvi@gmail.com>
---
 net/netrom/nr_route.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index b94cb2ffbaf8..788e375537fe 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -466,7 +466,6 @@ static int nr_dec_obs(void)
 				nr_neigh = s->routes[i].neighbour;
 
 				nr_neigh->count--;
-				nr_neigh_put(nr_neigh);
 
 				if (nr_neigh->count == 0 && !nr_neigh->locked)
 					nr_remove_neigh(nr_neigh);

base-commit: be548645527a131a097fdc884b7fca40c8b86231
-- 
2.34.1

Re: Testing for netrom: fix KASAN slab-use-after-free in nr_dec_obs()

Posted by Jakub Kicinski 3 weeks ago

On Sat, 17 Jan 2026 12:23:13 +0530 Prithvi Tambewagh wrote:
> #syz test upstream be548645527a131a097fdc884b7fca40c8b86231

Please do not CC the main mailing list on your testing attempts. 
Just CC syzbot

Re: Testing for netrom: fix KASAN slab-use-after-free in nr_dec_obs()

Posted by Prithvi 2 weeks, 6 days ago

On Sat, Jan 17, 2026 at 09:47:45AM -0800, Jakub Kicinski wrote:
> On Sat, 17 Jan 2026 12:23:13 +0530 Prithvi Tambewagh wrote:
> > #syz test upstream be548645527a131a097fdc884b7fca40c8b86231
> 
> Please do not CC the main mailing list on your testing attempts. 
> Just CC syzbot

Apologies for the inconvinience. I will take care to not repeat it.

Re: [syzbot] [hams?] KASAN: slab-use-after-free Read in nr_rt_ioctl

Posted by syzbot 3 weeks ago

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+df52f4216bf7b4d768e7@syzkaller.appspotmail.com
Tested-by: syzbot+df52f4216bf7b4d768e7@syzkaller.appspotmail.com

Tested on:

commit:         be548645 Merge tag 'for-linus' of git://git.kernel.org..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=149013fc580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=86243b7b185acc7e
dashboard link: https://syzkaller.appspot.com/bug?extid=df52f4216bf7b4d768e7
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16c6939a580000

Note: testing is done by a robot and is best-effort only.