Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nfc: llcp: Fix use-after-free in llcp_sock_release()

Browse source 
llcp_sock_release() unconditionally unlinks the socket from the local
sockets list.  However, if the socket is still in connecting state, it
is on the connecting list.

Fix this by checking the socket state and unlinking from the correct list.

Fixes: b4011239a0 ("NFC: llcp: Fix non blocking sockets connections")
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://patch.msgid.link/20260429134115.3558604-1-lee@kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>
This commit is contained in:
Lee Jones 2026-04-29 13:40:41 +00:00 • committed by David Heidelberg
commit f4268b4661
No known key found for this signature in database
GPG key ID: 60023FC4D3492072
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
net/nfc/llcp_sock.c
View file

@ -633,6 +633,8 @@ static int llcp_sock_release(struct socket *sock)
if (sock->type == SOCK_RAW)
nfc_llcp_sock_unlink(&local->raw_sockets, sk);
else if (sk->sk_state == LLCP_CONNECTING)
nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
else
nfc_llcp_sock_unlink(&local->sockets, sk);