Re: [BUG] KASAN: slab-use-after-free Read in slip_receive_buf

On Wed, Aug 26, 2026 at 7:53 AM Qingfang Deng [off-list ref] wrote:

On 2026/8/26 13:46, Eric Dumazet wrote:

quoted

On Wed, Aug 26, 2026 at 7:38 AM Qingfang Deng [off-list ref] wrote:

quoted

Hi,

On 2026/8/25 23:27, Eric Dumazet wrote:

quoted

This rings a bell; I had a local syzbot report for this issue a while back.

I think we should remove slip_hangup().

ppp_async.c and ppp_synctty.c have the same anti-pattern. Should we
remove theirs as well?

Probably, akthough ppp_async and ppp_synctty historically suffered
from this exact race, they added their own workaround: a global disc_data_lock,
refcount_t refcnt, and wait_for_completion(&ap->dead) on every callback.

Oh well.

Then the workaround should also be removed, according to the FIXME.

Relavent syzbot report:
https://lore.kernel.org/all/000000000000e8231f0601095c8e@google.com/ (local)

I can take care of slip_hanghup() removal, I will let you handle ppp :)