[PATCH v2] nfc: llcp: Fix nfc_dev refcount leak in connect

[PATCH v2] nfc: llcp: Fix nfc_dev refcount leak in connect

[Shuangpeng Bai]

llcp_sock_connect() takes a reference to the NFC device and keeps it
while a connection is active. For a nonblocking connection,
sock_wait_state() returns -EINPROGRESS while the socket remains in
LLCP_CONNECTING.

If the socket is released before reaching LLCP_CONNECTED,
llcp_sock_destruct() does not drop the reference because it only handles
connected sockets.

Drop the device reference in llcp_sock_release() when unlinking a
connecting socket. At this point llcp_sock->dev is still valid, unlike
after a failed blocking connection has cleared it.

Fixes: b4011239a08e ("NFC: llcp: Fix non blocking sockets connections")
Link: https://lore.kernel.org/r/20260707183518.1888697-1-shuangpeng.kernel@gmail.com
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
Changes in v2:
- Move the device put from llcp_sock_destruct() to llcp_sock_release()
  to avoid dereferencing a NULL llcp_sock->dev after a failed blocking
  connect.
- Add Fixes and Link tags.

 net/nfc/llcp_sock.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index feab29fc62f4..0a3d87c2c9b3 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -633,10 +633,12 @@ static int llcp_sock_release(struct socket *sock)
 
 	if (sock->type == SOCK_RAW)
 		nfc_llcp_sock_unlink(&local->raw_sockets, sk);
-	else if (sk->sk_state == LLCP_CONNECTING)
+	else if (sk->sk_state == LLCP_CONNECTING) {
 		nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
-	else
+		nfc_put_device(llcp_sock->dev);
+	} else {
 		nfc_llcp_sock_unlink(&local->sockets, sk);
+	}
 
 	if (llcp_sock->reserved_ssap < LLCP_SAP_MAX)
 		nfc_llcp_put_ssap(llcp_sock->local, llcp_sock->ssap);
-- 
2.43.0

Re: [PATCH v2] nfc: llcp: Fix nfc_dev refcount leak in connect

[Simon Horman]

This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260720193759.1773705-1-shuangpeng.kernel@gmail.com?part=1
---
Now I have all the information needed to write the report.

commit 01a1553c1a8c5e891087997a8fe9ee0913eb3c57
Author: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

nfc: llcp: Fix nfc_dev refcount leak in connect

This patch drops the nfc_dev reference in llcp_sock_release() when the
socket is still in LLCP_CONNECTING, addressing the leak path where
llcp_sock_destruct() only puts the device on LLCP_CONNECTED. The gate
is keyed on sk_state at release time.

Link: https://lore.kernel.org/r/20260707183518.1888697-1-shuangpeng.kernel@gmail.com

> diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
> index feab29fc62f4..0a3d87c2c9b3 100644
> --- a/net/nfc/llcp_sock.c
> +++ b/net/nfc/llcp_sock.c
> @@ -633,10 +633,12 @@ static int llcp_sock_release(struct socket *sock)
>
>  	if (sock->type == SOCK_RAW)
>  		nfc_llcp_sock_unlink(&local->raw_sockets, sk);
> -	else if (sk->sk_state == LLCP_CONNECTING)
> +	else if (sk->sk_state == LLCP_CONNECTING) {
>  		nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
> -	else
> +		nfc_put_device(llcp_sock->dev);
> +	} else {
>  		nfc_llcp_sock_unlink(&local->sockets, sk);
> +	}

[High]
Can the leak still occur when the peer answers the outstanding CONNECT
with a DM before userspace closes the socket?

After llcp_sock_connect() returns -EINPROGRESS, the sk sits on
local->connecting_sockets with sk_state == LLCP_CONNECTING and holds a
device reference. If a DM with LLCP_DM_NOBOUND or LLCP_DM_REJ arrives,
nfc_llcp_recv_dm() looks up the sk via nfc_llcp_connecting_sock_get()
and does:

    sk->sk_err = ENXIO;
    sk->sk_state = LLCP_CLOSED;
    sk->sk_state_change(sk);

It does not unlink the sk from connecting_sockets and does not drop the
device reference.

When llcp_sock_release() then runs, sk_state is LLCP_CLOSED, so this
new branch is skipped:

    else if (sk->sk_state == LLCP_CONNECTING) {
        nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
        nfc_put_device(llcp_sock->dev);
    } else {
        nfc_llcp_sock_unlink(&local->sockets, sk);
    }

Two things fall out of the else branch:

1. nfc_llcp_sock_unlink() is called against &local->sockets, but the sk
   is actually hashed on &local->connecting_sockets. sk_del_node_init()
   still removes it, but the wrong rwlock is taken, racing with
   read-side walkers of connecting_sockets such as
   nfc_llcp_connecting_sock_get() and nfc_llcp_recv_cc().

2. The device reference taken by llcp_sock_connect() is not dropped.
   llcp_sock_destruct() only puts it on LLCP_CONNECTED:

     if (sk->sk_state == LLCP_CONNECTED)
             nfc_put_device(llcp_sock->dev);

Is gating on sk_state at release time sufficient, or does the release
path need to track connecting_sockets membership (for example a
per-sock flag set at nfc_llcp_sock_link(&local->connecting_sockets, ...)
and cleared on transitions out of that list) so both the unlink target
and the nfc_put_device() are chosen based on where the sk actually
lives rather than its current state?

The DM-driven variant of this leak predates b4011239a08e, but the Fixes:
tag and the subject scope this patch as the fix for the connect-time
nfc_dev leak, so it seems worth handling in the same change.