Messages in this thread |  | | From | Eric Dumazet <> | | Date | Wed, 29 Apr 2026 06:26:45 -0700 | | Subject | Re: [PATCH 1/1] nfc: llcp: fix use-after-free in llcp_sock_release() |
| |
On Wed, Apr 29, 2026 at 6:22 AM Lee Jones <lee@kernel.org> wrote: > > llcp_sock_release() unconditionally unlinks the socket from the local > sockets list. However, if the socket is still in connecting state, it > is on the connecting list. > > Fix this by checking the socket state and unlinking from the correct list. > > Signed-off-by: Lee Jones <lee@kernel.org> > --- > net/nfc/llcp_sock.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c > index f1be1e84f6653..feab29fc62f44 100644 > --- a/net/nfc/llcp_sock.c > +++ b/net/nfc/llcp_sock.c > @@ -633,6 +633,8 @@ static int llcp_sock_release(struct socket *sock) > > if (sock->type == SOCK_RAW) > nfc_llcp_sock_unlink(&local->raw_sockets, sk); > + else if (sk->sk_state == LLCP_CONNECTING) > + nfc_llcp_sock_unlink(&local->connecting_sockets, sk); > else > nfc_llcp_sock_unlink(&local->sockets, sk); > > -- > 2.54.0.545.g6539524ca2-goog >
Why are you sending this patch a second time?
You forgot to add a Fixes: tag, as requested for all networking patches.
|  |