Re: [PATCH net 1/1] nfc: digital: fix use-after-free in unregister

[Simon Horman <horms@kernel.org>]

On Mon, Oct 26, 2026 at 03:24:07PM +0800, Yuqi Xu wrote:
> nfc_digital_unregister_device() cancels its own workqueue items and
> then frees every queued digital_cmd. A command already submitted to
> the driver remains the argument of the async completion.
> digital_send_cmd_complete() can still assign cmd->resp after that
> object has been freed, which is a use-after-free.
> 
> Abort the in-flight driver command before reclaiming the queue, and
> drain the completion work the driver may schedule from abort. Once
> the nfc device is shutting down, do not queue or submit another
> command: finishing the aborted one would otherwise hand the next
> queued command to the driver while it is being freed.
> 
> Port100 and nfcsim invoke the digital completion from a private work
> item, so flush that work before abort returns. trf7970a completes from
> a delayed timeout work and from its IRQ thread; handle its MD listening
> state in abort and shutdown, and stop the timer before the device is
> released. st95hf's IRQ thread can observe that remove already ran and
> must not call back into the freed command.
> 
> Fixes: 59ee2361c924 ("NFC Digital: Implement driver commands mechanism")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
> Reviewed-by: Ren Wei <weir@nebusec.ai>

Reviewed-by: Simon Horman <horms@kernel.org>