[PATCH net v2 0/1] net: nfc: Fix use-after-free in general bytes retrieval

[Ren Wei <weir@nebusec.ai>]

From: Luxiao Xu <rakukuip@gmail.com>

Hi,

This patch fixes a use-after-free (UAF) bug in nfc_get_local_general_bytes()
where the local structure could be freed prematurely by nfc_llcp_local_put()
before the returned pointer was accessed by callers.

The fix refactors nfc_llcp_general_bytes() and nfc_get_local_general_bytes()
to accept a caller-provided destination buffer and copies the general bytes
safely before decrementing the reference count.

Changes in v2:
 - Fix GCC -Waddress compiler warning in nfc_llcp_general_bytes() by removing
   the redundant nullness check on 'local->gb' array.
 - Fix line wrap indentation and column width across modified driver files to
   conform to the 80-column limit.
v1 Link: https://lore.kernel.org/netdev/cover.1786029423.git.rakukuip@gmail.com/

Thanks,
Ren
Luxiao Xu

Luxiao Xu (1):
  net: nfc: fix use-after-free in nfc_get_local_general_bytes

 drivers/nfc/microread/microread.c |  6 +++---
 drivers/nfc/pn533/pn533.c         | 14 ++++++++------
 drivers/nfc/pn533/pn533.h         |  2 +-
 drivers/nfc/pn544/pn544.c         |  7 +++----
 drivers/nfc/st21nfca/core.c       |  8 ++++----
 include/net/nfc/hci.h             |  2 +-
 include/net/nfc/nfc.h             |  3 ++-
 net/nfc/core.c                    | 15 +++++++--------
 net/nfc/digital_dep.c             |  8 ++++----
 net/nfc/llcp_core.c               | 17 +++++++++++++----
 net/nfc/nci/core.c                | 16 +++++++---------
 net/nfc/nfc.h                     |  3 ++-
 12 files changed, 55 insertions(+), 46 deletions(-)

-- 
2.43.0