lkml.org 
[lkml]   [2026]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 1/1] nfc: llcp: fix use-after-free in llcp_sock_release()
On Wed, Apr 29, 2026 at 6:22 AM Lee Jones <lee@kernel.org> wrote:
>
> llcp_sock_release() unconditionally unlinks the socket from the local
> sockets list. However, if the socket is still in connecting state, it
> is on the connecting list.
>
> Fix this by checking the socket state and unlinking from the correct list.
>
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
> net/nfc/llcp_sock.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
> index f1be1e84f6653..feab29fc62f44 100644
> --- a/net/nfc/llcp_sock.c
> +++ b/net/nfc/llcp_sock.c
> @@ -633,6 +633,8 @@ static int llcp_sock_release(struct socket *sock)
>
> if (sock->type == SOCK_RAW)
> nfc_llcp_sock_unlink(&local->raw_sockets, sk);
> + else if (sk->sk_state == LLCP_CONNECTING)
> + nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
> else
> nfc_llcp_sock_unlink(&local->sockets, sk);
>
> --
> 2.54.0.545.g6539524ca2-goog
>

Why are you sending this patch a second time?

You forgot to add a Fixes: tag, as requested for all networking patches.

\
 
 \ /
  Last update: 2026-04-29 15:38    [W:0.109 / U:39.804 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and my Meterkast|Read the blog