Shuangpeng Bai reported a slab-use-after-free in nfc_llcp_tx_work(): BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave Write of size 4 at addr ffff88811da9cb94 by task kworker/0:0/9 Call Trace: _raw_spin_lock_irqsave (kernel/locking/spinlock.c:166) skb_queue_tail (net/core/skbuff.c:4114) nfc_llcp_tx_work (net/nfc/llcp_core.c:848) When transmitting an I-frame, nfc_llcp_tx_work() creates a copy via skb_copy() to keep in tx_pending_queue. If the socket is closed concurrently, freeing the original skb during nfc_data_exchange() drops sk_wmem_alloc to 0 and destroys the socket before copy_skb is queued to llcp_sock->tx_pending_queue. Call skb_set_owner_w(copy_skb, sk) to keep the socket alive while copy_skb is queued. Fixes: be02b6b62400 ("NFC: Queue a copy of the transmitted LLCP skb") Reported-by: Shuangpeng Bai Closes: https://lore.kernel.org/netdev/20260819050031.2725592-1-shuangpeng.kernel@gmail.com/ Signed-off-by: Eric Dumazet --- Cc: David Heidelberg Cc: oe-linux-nfc@lists.linux.dev --- net/nfc/llcp_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index cac1b5487064d0c5b4966bb6a75aa26e67131049..49cb632268c0c2841e3b44dde124c7966267b709 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -786,8 +786,11 @@ static void nfc_llcp_tx_work(struct work_struct *work) print_hex_dump_debug("LLCP Tx: ", DUMP_PREFIX_OFFSET, 16, 1, skb->data, skb->len, true); - if (ptype == LLCP_PDU_I) + if (ptype == LLCP_PDU_I) { copy_skb = skb_copy(skb, GFP_ATOMIC); + if (copy_skb) + skb_set_owner_w(copy_skb, sk); + } __net_timestamp(skb); -- 2.55.0.766.g2966f0265a-goog