Re: [BUG] nfc: llcp: race between nfc_llcp_send_ui_frame() and llcp_sock_bind() dereferences NULL sock->dev

[David Heidelberg <david@ixit.cz>]

On 14/07/2026 02:00, Junwoong Doh wrote:
> Hello,
> 
> Commit dded08927ca3 ("nfc: llcp: fix NULL error pointer dereference on
> sendmsg() after failed bind()") added a NULL check for llcp_sock->local
> in llcp_sock_sendmsg(), but it does not handle all the races.
> The thread interleaving is the same as Krzysztof mentioned:
> https://lore.kernel.org/oe-linux-nfc/20220119074816.6505-2-krzysztof.kozlowski@canonical.com/
> 
> In detail:
> nfc_llcp_send_ui_frame() checks sock->local == NULL, but it is called
> without socket's lock held, which opens a window for a race condition.
> Between the sock->local == NULL check and the sock->dev use in
> nfc_alloc_send_skb(), llcp_sock_bind() can run concurrently and set
> both sock->local and sock->dev to NULL.
> This leads to NULL pointer dereference in the nfc_alloc_send_skb() call.
> Moreover, the window can be enlarged by the
> memcpy_from_msg(msg_data, msg, len) call that sits between
> the sock->local check and the sock->dev use.

Hello Junwoong,

thank you for the report. Would you be willing to try preparing a patch against 
the NFC for-next or for-linus tree to fix the issue?

Thank you
David

[...]