From nobody Sun Feb 8 15:59:14 2026 Received: from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F94228AAEE for ; Sun, 18 Jan 2026 13:23:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768742585; cv=none; b=eWq12PXZ13mHKss35/5v51M9Hsg7yOu74RFhbdlsUnE5Zjmd6DNhi9/cVux6tmqQ0k4+bpRLqkXCvjdt1W1gwfJN5yxPbb915y/Fh1kRBgW7WIOI6a37rmOyfy6NJijY5ss6N56St0g8MDZHt5Np+AvnqjbHY35/TApIKuMTQP8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768742585; c=relaxed/simple; bh=xJeCIAr4eiDHmsgMlbA2mJdwb2C35Gj9ScxyRzocpXU=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=sAM8OshbUwAptziv49ArIbMI8+h2LrxbDKCzzF0AptqMiZQ3A1VkZL/ShhNHmWQJU7AY9ZuSyO9Y82DXojIcNj1TXQNsQzvvv5SIXTRgVHSqA4hw1En2PzuqiS8WrZkidFSVzAXJvZ6Zh2zJuiDSROZpc1PugMhdESgXkGu/BOk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-66107de5f96so9044811eaf.1 for ; Sun, 18 Jan 2026 05:23:04 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768742583; x=1769347383; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/TELco0/ZQ+QYkbS3BJnOyIvJFxANtrCpJoSmvD9MF4=; b=pSecQewN02aZr/Cj93PChbnEcO156UO1yrFBviCBIbvggTlULF0X7UcwwpKCfTmQdz ScXYjB5Wq679/mVIBdhptOz01qCV74UFpxGxKVruZhi/G5FeMBfTSsNpbr/J6/wJmg0C 0BSNMxskWCfuIESJZql79KKK0IL8MF4ezohb/CmbWsJN3wiLaH1jFFjtxNwo1hDl2ATb 2sTGP4xMTNlhqXVWfa6zvO6nMSz9AELZsgfnGZGIoDVZ80g724BfxkAh9U9zpE5eaHUx u8cN68lCli6ohEJy61JiNLAl3+RZGLiozg1LgsLKWhp8GhezWhWhO4xtMfvP1Bk6naeK s/cw== X-Gm-Message-State: AOJu0YzqoelT56rLLv8mOsyzGRvFH5BBhP+DNKR33yy6/JWVvvhuh5wk gvqQ2+b8hB3zZ03sDK1ciicVQx0RviNw1bW+e60HPkUOsIZ/8zYBg8ls+3r98cCQMiTVnSmKxs2 h4V9AU0Z525nXr+XUFYM4wVqE+bwUFfZo0vDz1R2TBbjs6ofe3OOyK4KMVuA= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a4a:a544:0:b0:661:8a3:ad19 with SMTP id 006d021491bc7-6610e65399fmr5380283eaf.30.1768742583385; Sun, 18 Jan 2026 05:23:03 -0800 (PST) Date: Sun, 18 Jan 2026 05:23:03 -0800 In-Reply-To: <69694da9.050a0220.58bed.002a.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <696cdeb7.050a0220.3390f1.001d.GAE@google.com> Subject: Forwarded: Testing for netrom: fix KASAN slab-use-after-free in nr_dec_obs() From: syzbot To: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org. *** Subject: Testing for netrom: fix KASAN slab-use-after-free in nr_dec_obs() Author: activprithvi@gmail.com #syz test upstream be548645527a131a097fdc884b7fca40c8b86231 Signed-off-by: Prithvi Tambewagh --- net/netrom/nr_route.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c index b94cb2ffbaf8..f84227acbf68 100644 --- a/net/netrom/nr_route.c +++ b/net/netrom/nr_route.c @@ -466,10 +466,12 @@ static int nr_dec_obs(void) nr_neigh =3D s->routes[i].neighbour; =20 nr_neigh->count--; - nr_neigh_put(nr_neigh); =20 if (nr_neigh->count =3D=3D 0 && !nr_neigh->locked) nr_remove_neigh(nr_neigh); + else + nr_neigh_put(nr_neigh); + =20 s->count--; =20 base-commit: be548645527a131a097fdc884b7fca40c8b86231 --=20 2.34.1