From: Joe Damato <joe@dama.to>
To: Jakub Kicinski <kuba@kernel.org>
Cc: davem@davemloft.net, netdev@vger.kernel.org, edumazet@google.com,
pabeni@redhat.com, andrew+netdev@lunn.ch, horms@kernel.org
Subject: Re: [PATCH net 3/5] nfc: nci: complete pending data exchange on device close
Date: Tue, 3 Mar 2026 14:03:56 -0800 [thread overview]
Message-ID: <aadazAolRVOqhNK9@devvm20253.cco0.facebook.com> (raw)
In-Reply-To: <20260303162346.2071888-4-kuba@kernel.org>
On Tue, Mar 03, 2026 at 08:23:43AM -0800, Jakub Kicinski wrote:
> In nci_close_device(), complete any pending data exchange before
> closing. The data exchange callback (e.g.
> rawsock_data_exchange_complete) holds a socket reference.
>
> NIPA occasionally hits this leak:
>
> unreferenced object 0xff1100000f435000 (size 2048):
> comm "nci_dev", pid 3954, jiffies 4295441245
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............
> backtrace (crc ec2b3c5):
> __kmalloc_noprof+0x4db/0x730
> sk_prot_alloc.isra.0+0xe4/0x1d0
> sk_alloc+0x36/0x760
> rawsock_create+0xd1/0x540
> nfc_sock_create+0x11f/0x280
> __sock_create+0x22d/0x630
> __sys_socket+0x115/0x1d0
> __x64_sys_socket+0x72/0xd0
> do_syscall_64+0x117/0xfc0
> entry_SYSCALL_64_after_hwframe+0x4b/0x53
>
> Fixes: 38f04c6b1b68 ("NFC: protect nci_data_exchange transactions")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> net/nfc/nci/core.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
Reviewed-by: Joe Damato <joe@dama.to>
next prev parent reply other threads:[~2026-03-03 22:03 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-03 16:23 [PATCH net 0/5] nfc: fix leaks and races surfaced by NIPA Jakub Kicinski
2026-03-03 16:23 ` [PATCH net 1/5] nfc: nci: free skb on nci_transceive early error paths Jakub Kicinski
2026-03-03 21:02 ` Joe Damato
2026-03-03 16:23 ` [PATCH net 2/5] nfc: digital: free skb on digital_in_send " Jakub Kicinski
2026-03-03 21:04 ` Joe Damato
2026-03-03 16:23 ` [PATCH net 3/5] nfc: nci: complete pending data exchange on device close Jakub Kicinski
2026-03-03 22:03 ` Joe Damato [this message]
2026-03-03 16:23 ` [PATCH net 4/5] nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback Jakub Kicinski
2026-03-03 22:46 ` Joe Damato
2026-03-03 16:23 ` [PATCH net 5/5] nfc: rawsock: cancel tx_work before socket teardown Jakub Kicinski
2026-03-03 22:51 ` Joe Damato
2026-03-24 13:31 ` Guenter Roeck
2026-03-05 2:40 ` [PATCH net 0/5] nfc: fix leaks and races surfaced by NIPA patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aadazAolRVOqhNK9@devvm20253.cco0.facebook.com \
--to=joe@dama.to \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.