From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f182.google.com (mail-yw1-f182.google.com [209.85.128.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46EF12DCF74 for ; Sat, 25 Jul 2026 11:56:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784980583; cv=none; b=n0UfMC3nji2LayEeRcxLofw8pdDp8KArywTXGgQcEMq6kq9YeStCJix6r1/0T7IolxbDtnsgIn9KYDAXyuPCbBW56SrgLNqUHFrbgSokVI0WmoKxyNKZjtbizNvtAk0bRsdKI3DI97PbXPY6wCvQ4kjrgkMoBZklsWmZP8Ob2l4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784980583; c=relaxed/simple; bh=HoumKy1SZGGYhjHhoiDceuBl9nlvS4cV0Z64vMRnez0=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=IrfVF2MjqfwzqPeHORb5xqFmqxciQLiLkAtvkZ7lNC0YsKtl0umfDTsXU1q1CyW1KY8Wf/U2EHwnLXJ1nQlz4DndWFpvvF3UdCHcBt+4VkHw3pCNmy4LgZq9riDyu1X2wZdWu5uXZIDfr3+yNYQXYzClk4MSLvHfIm704sRl5b4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=d1dcWblA; arc=none smtp.client-ip=209.85.128.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="d1dcWblA" Received: by mail-yw1-f182.google.com with SMTP id 00721157ae682-81e8fa1b8d6so12899917b3.1 for ; Sat, 25 Jul 2026 04:56:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784980581; x=1785585381; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8pMX2F7Mtpmm/z0irFwhF72qBFAkYFT3rWJazByM9SY=; b=d1dcWblA7rYPY8jRvmLsUH9cBNjLtmrQ9s0Oo3hV0JD0lErtlmfDe4Fuis5z/uAqeY 2ZqnUxuM9rIa6NbbbwunkLbvc2SaKPMLuPJwzRq1Op/A9PxmilCLL2+pzyS7PAN5r+6O FhJT1LfRcsNle44i/60Ajw2eVHkSWQTD6UsVqnyl88RXg5aeebfCCa7MR5K6U5JOWcH1 SlMzFpBMrEG3Gi2rOe6LyWL5wDxK0wQqTEW4gwsl6itEHISLpFwOO6Z+Okkf0syepMcT aeha/grkgFkU8E7ffaYzRTDXnsPVz2FbMSQOxPSh89nyj9wB5n+KDNbarmNaSNhlwABZ 5Ajg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784980581; x=1785585381; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8pMX2F7Mtpmm/z0irFwhF72qBFAkYFT3rWJazByM9SY=; b=mTaDi5s9Pl9xm0A0jUn/4RfpzQtJelQBvIs5LnYzdua8ilXD51UMOGu9c7hCVEGc9g 4CtgUSIv41a653jwMrOor6AOep7m0mzTmWjjJaBKLHlL1VK3CSbWmvUk2VNYstQoVxQm rSx5xrCUz+yIvj0xNGDNicbPhKf2ECRRmhrTdgMkmd1mmnvBD3/5ZHOgrWwjtOZ1sD+8 jt7oj6UM+3fvDWR56rWYEaNZxIA1X9RZsu8qpJpRd6TuflVil88swjxY8K4z7ucx5mu4 UZgo1HQYIE1U3v2Flo7QyZxThReSmepSiCaV3S2Hjglnyg1Rt4B5Hlm3TL/tj1aEgyaz 2HRQ== X-Forwarded-Encrypted: i=1; AHgh+RqoyPrHedy89ayhf3ovcotTos6+g7moye/GeH9AxXI5/0KgsL7VW4wGhxSA1nh007EwhpzANRhjlWQzVM0=@vger.kernel.org X-Gm-Message-State: AOJu0Yw5+wjOuxYJu2MeSsWlRmrPiHQPUdcZQXvyQ/Dxp2UanzYHsmce NvgelZtcUU+Z6WtfOCuijymJOh/vo8gmIIOqIk/cvvlFdRL79XbcH/2g X-Gm-Gg: AR+sD10FtcN2fmAOA2qon3z9shaMEl8U+dXTdYB8FE3fjrgR6ZnWcEaa/IDhMfG8RGd ASxGj2wD9EhF14Gy8Hx3+Cev4TwPJdT2hFrm5JBVyFD6rE9PyX2YwuEkgi2NPP57a2nrsCt2II6 1UrWA4pzNBCXCdgzbyfx3KQ1ojMrjmtt/ui8CrBgOD1t1upFR3aNnDZDkNP0+GGseWpYLorlSv7 5PZZnyPv07mNfVAYkWhzLfT4u9yYXObzdmDvxilJpUMAB1/00pMCuSfbvWi4gLuvSkKAgOQksvd ZVVGEfsjbPAVinnMThvP+Y7FbQ6F0vFuDYJJHlcwzLpRVp10CWf1o7nfnHfUR7fdkE0oF6xVMKr yXyhW9lm8ZdwhnqHrvQg/V4B7ldkFghNRx+MHdjxd0k/18BZh23PEepwTiwiNOQx9Y+ao4lYsOo oT8iMsa0k= X-Received: by 2002:a05:690c:4483:b0:7cf:f14e:bf5a with SMTP id 00721157ae682-81f69d151b2mr6955017b3.20.1784980581193; Sat, 25 Jul 2026 04:56:21 -0700 (PDT) Received: from jdoh-CompSec.. ([141.223.124.60]) by smtp.gmail.com with ESMTPSA id 00721157ae682-81f657a14d9sm11259497b3.13.2026.07.25.04.56.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 25 Jul 2026 04:56:19 -0700 (PDT) From: Junwoong Doh To: David Heidelberg Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Krzysztof Kozlowski , oe-linux-nfc@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Junwoong Doh Subject: [PATCH net] nfc: llcp: fix NULL pointer dereference race in nfc_llcp_send_ui_frame() Date: Sat, 25 Jul 2026 20:55:56 +0900 Message-Id: <20260725115556.1250160-1-jdoh.kernel@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nfc_llcp_send_ui_frame() checks whether sock->local is NULL, but it is called by llcp_sock_sendmsg() without the socket lock held, which opens a window for a race condition. Between the sock->local check and the sock->dev use in nfc_alloc_send_skb(), llcp_sock_bind() can run concurrently and set both sock->local and sock->dev to NULL, which can lead to a NULL pointer dereference in nfc_alloc_send_skb(). Take the socket lock in nfc_llcp_send_ui_frame() so that the sock->local check and the sock->dev use are performed under it. The message is copied from user space before the lock is taken, to avoid holding the lock across a user space access that can block for an unbounded amount of time. Fixes: dded08927ca3 ("nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()") Signed-off-by: Junwoong Doh Link: https://lore.kernel.org/all/a89d0419-8bcf-40a2-b52d-3e5d911f11da@gmail.com/ --- net/nfc/llcp_commands.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c index 291f26facbf3..cfd5f6aebf8d 100644 --- a/net/nfc/llcp_commands.c +++ b/net/nfc/llcp_commands.c @@ -730,6 +730,7 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, struct msghdr *msg, size_t len) { struct sk_buff *pdu; + struct sock *sk = &sock->sk; struct nfc_llcp_local *local; size_t frag_len = 0, remaining_len; u8 *msg_ptr, *msg_data; @@ -738,10 +739,6 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, pr_debug("Send UI frame len %zd\n", len); - local = sock->local; - if (local == NULL) - return -ENODEV; - msg_data = kmalloc(len, GFP_USER | __GFP_NOWARN); if (msg_data == NULL) return -ENOMEM; @@ -751,6 +748,15 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, return -EFAULT; } + lock_sock(sk); + + local = sock->local; + if (local == NULL) { + release_sock(sk); + kfree(msg_data); + return -ENODEV; + } + remaining_len = len; msg_ptr = msg_data; @@ -763,7 +769,7 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, pr_debug("Fragment %zd bytes remaining %zd", frag_len, remaining_len); - pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0, + pdu = nfc_alloc_send_skb(sock->dev, sk, 0, frag_len + LLCP_HEADER_SIZE, &err); if (pdu == NULL) { pr_err("Could not allocate PDU (error=%d)\n", err); @@ -800,6 +806,7 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, msg_ptr += frag_len; } while (remaining_len > 0); + release_sock(sk); kfree(msg_data); return len; -- 2.34.1