[PATCH net] nfc: llcp: fix UAF on socket in nfc_llcp_tx_work()

[PATCH net] nfc: llcp: fix UAF on socket in nfc_llcp_tx_work()

[Eric Dumazet]

Shuangpeng Bai reported a slab-use-after-free in nfc_llcp_tx_work():

  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
  Write of size 4 at addr ffff88811da9cb94 by task kworker/0:0/9
  Call Trace:
   _raw_spin_lock_irqsave (kernel/locking/spinlock.c:166)
   skb_queue_tail (net/core/skbuff.c:4114)
   nfc_llcp_tx_work (net/nfc/llcp_core.c:848)

When transmitting an I-frame, nfc_llcp_tx_work() creates a copy via
skb_copy() to keep in tx_pending_queue. If the socket is closed
concurrently, freeing the original skb during nfc_data_exchange()
drops sk_wmem_alloc to 0 and destroys the socket before copy_skb is
queued to llcp_sock->tx_pending_queue.

Call skb_set_owner_w(copy_skb, sk) to keep the socket alive while
copy_skb is queued.

Fixes: be02b6b62400 ("NFC: Queue a copy of the transmitted LLCP skb")
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/netdev/20260819050031.2725592-1-shuangpeng.kernel@gmail.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
Cc: David Heidelberg <david@ixit.cz>
Cc: oe-linux-nfc@lists.linux.dev
---
 net/nfc/llcp_core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index cac1b5487064d0c5b4966bb6a75aa26e67131049..49cb632268c0c2841e3b44dde124c7966267b709 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -786,8 +786,11 @@ static void nfc_llcp_tx_work(struct work_struct *work)
 			print_hex_dump_debug("LLCP Tx: ", DUMP_PREFIX_OFFSET,
 					     16, 1, skb->data, skb->len, true);
 
-			if (ptype == LLCP_PDU_I)
+			if (ptype == LLCP_PDU_I) {
 				copy_skb = skb_copy(skb, GFP_ATOMIC);
+				if (copy_skb)
+					skb_set_owner_w(copy_skb, sk);
+			}
 
 			__net_timestamp(skb);
 
-- 
2.55.0.766.g2966f0265a-goog

Re: [PATCH net] nfc: llcp: fix UAF on socket in nfc_llcp_tx_work()

[Shuangpeng]

Thanks for your patch!

Tested-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

On Aug 21, 2026, at 10:13, Eric Dumazet <edumazet@google.com> wrote:
> 
> Shuangpeng Bai reported a slab-use-after-free in nfc_llcp_tx_work():
> 
>  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
>  Write of size 4 at addr ffff88811da9cb94 by task kworker/0:0/9
>  Call Trace:
>   _raw_spin_lock_irqsave (kernel/locking/spinlock.c:166)
>   skb_queue_tail (net/core/skbuff.c:4114)
>   nfc_llcp_tx_work (net/nfc/llcp_core.c:848)
> 
> When transmitting an I-frame, nfc_llcp_tx_work() creates a copy via
> skb_copy() to keep in tx_pending_queue. If the socket is closed
> concurrently, freeing the original skb during nfc_data_exchange()
> drops sk_wmem_alloc to 0 and destroys the socket before copy_skb is
> queued to llcp_sock->tx_pending_queue.
> 
> Call skb_set_owner_w(copy_skb, sk) to keep the socket alive while
> copy_skb is queued.
> 
> Fixes: be02b6b62400 ("NFC: Queue a copy of the transmitted LLCP skb")
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> Closes: https://lore.kernel.org/netdev/20260819050031.2725592-1-shuangpeng.kernel@gmail.com/
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> Cc: David Heidelberg <david@ixit.cz>
> Cc: oe-linux-nfc@lists.linux.dev
> ---
> net/nfc/llcp_core.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index cac1b5487064d0c5b4966bb6a75aa26e67131049..49cb632268c0c2841e3b44dde124c7966267b709 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -786,8 +786,11 @@ static void nfc_llcp_tx_work(struct work_struct *work)
> print_hex_dump_debug("LLCP Tx: ", DUMP_PREFIX_OFFSET,
>     16, 1, skb->data, skb->len, true);
> 
> - if (ptype == LLCP_PDU_I)
> + if (ptype == LLCP_PDU_I) {
> copy_skb = skb_copy(skb, GFP_ATOMIC);
> + if (copy_skb)
> + skb_set_owner_w(copy_skb, sk);
> + }
> 
> __net_timestamp(skb);
> 
> -- 
> 2.55.0.766.g2966f0265a-goog
>