From: Simon Horman <horms@kernel.org>
To: Kuniyuki Iwashima <kuniyu@google.com>
Cc: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Samuel Ortiz <sameo@linux.intel.com>,
Kuniyuki Iwashima <kuni1840@gmail.com>,
netdev@vger.kernel.org,
syzbot+f2d245f1d76bbfa50e4c@syzkaller.appspotmail.com
Subject: Re: [PATCH v1 net] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
Date: Mon, 26 Jan 2026 17:24:32 +0000 [thread overview]
Message-ID: <aXejUMWyl51mlr5Q@horms.kernel.org> (raw)
In-Reply-To: <20260125010214.1572439-1-kuniyu@google.com>
On Sun, Jan 25, 2026 at 12:59:28AM +0000, Kuniyuki Iwashima wrote:
> syzbot reported various memory leaks related to NFC, struct
> nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]
>
> The leading log hinted that nfc_llcp_send_ui_frame() failed
> to allocate skb due to sock_error(sk) being -ENXIO.
>
> ENXIO is set by nfc_llcp_socket_release() when struct
> nfc_llcp_local is destroyed by local_cleanup().
>
> The problem is that there is no synchronisation between
> nfc_llcp_send_ui_frame() and local_cleanup(), and skb
> could be put into local->tx_queue after it was purged in
> local_cleanup():
>
> CPU1 CPU2
> ---- ----
> nfc_llcp_send_ui_frame() local_cleanup()
> |- do { '
> |- pdu = nfc_alloc_send_skb(..., &err)
> | .
> | |- nfc_llcp_socket_release(local, false, ENXIO);
> | |- skb_queue_purge(&local->tx_queue); |
> | ' |
> |- skb_queue_tail(&local->tx_queue, pdu); |
> ... |
> |- pdu = nfc_alloc_send_skb(..., &err) |
> ^._________________________________.'
>
> local_cleanup() is called for struct nfc_llcp_local only
> after nfc_llcp_remove_local() unlinks it from llcp_devices.
>
> If we hold local->tx_queue.lock then, we can synchronise
> the thread and nfc_llcp_send_ui_frame().
>
> Let's do that and check list_empty(&local->list) before
> queuing skb to local->tx_queue in nfc_llcp_send_ui_frame().
...
> Fixes: 94f418a20664 ("NFC: UI frame sending routine implementation")
> Reported-by: syzbot+f2d245f1d76bbfa50e4c@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/697569c7.a00a0220.33ccc7.0014.GAE@google.com/T/#u
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
next prev parent reply other threads:[~2026-01-26 17:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-25 0:59 [PATCH v1 net] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame() Kuniyuki Iwashima
2026-01-26 17:24 ` Simon Horman [this message]
2026-01-27 4:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXejUMWyl51mlr5Q@horms.kernel.org \
--to=horms@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=kuni1840@gmail.com \
--cc=kuniyu@google.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sameo@linux.intel.com \
--cc=syzbot+f2d245f1d76bbfa50e4c@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox