* Forwarded: [PATCH] nfc: llcp: clear stale device pointers on socket close
[not found] <20260928014639.2230819-1-qwe.aldo@gmail.com>
@ 2026-09-28 1:46 ` syzbot
2026-09-28 3:36 ` [syzbot ci] Re: nfc: llcp: prevent resource leak on repeated connect after DM syzbot ci
0 siblings, 1 reply; 2+ messages in thread
From: syzbot @ 2026-09-28 1:46 UTC (permalink / raw)
To: syzbot; +Cc: syzbot, qwe.aldo
For archival purposes, forwarding an incoming command email to
syzbot@lists.linux.dev.
***
Subject: [PATCH] nfc: llcp: clear stale device pointers on socket close
Author: qwe.aldo@gmail.com
#syz test
nfc_llcp_socket_release() and nfc_llcp_recv_dm() can move a socket
to LLCP_CLOSED without clearing llcp_sock->dev. A bound socket
never owned a device reference (bind puts its temporary ref), and
a connected socket reference is already released here. A later
reconnect attempt would then put a device reference the socket does
not own.
Clear the pointer when a socket becomes closed so that the reconnect
cleanup only puts references it actually holds.
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
net/nfc/llcp_core.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index cac1b5487..f2530bebe 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -81,8 +81,14 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device,
nfc_llcp_socket_purge(llcp_sock);
- if (sk->sk_state == LLCP_CONNECTED)
+ if (sk->sk_state == LLCP_CONNECTED) {
nfc_put_device(llcp_sock->dev);
+ llcp_sock->dev = NULL;
+ } else if (sk->sk_state == LLCP_BOUND ||
+ sk->sk_state == LLCP_LISTEN) {
+ /* bind() already dropped its temporary device reference. */
+ llcp_sock->dev = NULL;
+ }
if (sk->sk_state == LLCP_LISTEN) {
struct nfc_llcp_sock *lsk, *n;
@@ -1276,6 +1282,10 @@ static void nfc_llcp_recv_dm(struct nfc_llcp_local *local,
sk = &llcp_sock->sk;
+ /* Bound and listening sockets do not own a device reference. */
+ if (sk->sk_state == LLCP_BOUND || sk->sk_state == LLCP_LISTEN)
+ llcp_sock->dev = NULL;
+
sk->sk_err = ENXIO;
sk->sk_state = LLCP_CLOSED;
sk->sk_state_change(sk);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread