Forwarded: [PATCH] nfc: llcp: clear stale device pointers on socket close

Forwarded: [PATCH] nfc: llcp: clear stale device pointers on socket close

[syzbot]

For archival purposes, forwarding an incoming command email to
syzbot@lists.linux.dev.

***

Subject: [PATCH] nfc: llcp: clear stale device pointers on socket close
Author: qwe.aldo@gmail.com

#syz test

nfc_llcp_socket_release() and nfc_llcp_recv_dm() can move a socket
to LLCP_CLOSED without clearing llcp_sock->dev.  A bound socket
never owned a device reference (bind puts its temporary ref), and
a connected socket reference is already released here.  A later
reconnect attempt would then put a device reference the socket does
not own.

Clear the pointer when a socket becomes closed so that the reconnect
cleanup only puts references it actually holds.

Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 net/nfc/llcp_core.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index cac1b5487..f2530bebe 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -81,8 +81,14 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device,
 
 		nfc_llcp_socket_purge(llcp_sock);
 
-		if (sk->sk_state == LLCP_CONNECTED)
+		if (sk->sk_state == LLCP_CONNECTED) {
 			nfc_put_device(llcp_sock->dev);
+			llcp_sock->dev = NULL;
+		} else if (sk->sk_state == LLCP_BOUND ||
+			   sk->sk_state == LLCP_LISTEN) {
+			/* bind() already dropped its temporary device reference. */
+			llcp_sock->dev = NULL;
+		}
 
 		if (sk->sk_state == LLCP_LISTEN) {
 			struct nfc_llcp_sock *lsk, *n;
@@ -1276,6 +1282,10 @@ static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
 
 	sk = &llcp_sock->sk;
 
+	/* Bound and listening sockets do not own a device reference. */
+	if (sk->sk_state == LLCP_BOUND || sk->sk_state == LLCP_LISTEN)
+		llcp_sock->dev = NULL;
+
 	sk->sk_err = ENXIO;
 	sk->sk_state = LLCP_CLOSED;
 	sk->sk_state_change(sk);
-- 
2.43.0

[syzbot ci] Re: nfc: llcp: prevent resource leak on repeated connect after DM

[syzbot ci]

syzbot ci has tested the suggested fix patch on top of the following series:

[v2] nfc: llcp: prevent resource leak on repeated connect after DM
https://lore.kernel.org/all/20260925184857.357926-1-qwe.aldo@gmail.com

Patch: https://ci.syzbot.org/jobs/da6ffc80-6044-443a-a9ca-b63e5a06610d/patch
Testing results:
* [build 0] Build Patched: passed
* [build 0] Boot test: Patched: passed
* [build 0] Previous reproducers: passed
  - KASAN: slab-use-after-free Read in llcp_sock_connect (patched) - passed
  - KASAN: slab-use-after-free Read in nfc_remove_device (patched) - passed

Full report is available here:
https://ci.syzbot.org/session/3f61304c-d949-4760-b6a1-f43b0fb5862d

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.