From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DAB02309AA for ; Wed, 17 Dec 2025 01:41:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765935663; cv=none; b=iuMOqSmfc7UHRaa8XbVSnop5JWFyLd23ekeEQLkgiJRI60lwMZxHoVaF4kBYGpCycrRQq4vkUN/e8zVSZWBcyximdp2bnersA+3c+i5Veg/fGQ0NPpRUwmboHg4acAxKV/sfmwvC73hfllnHOBWarm5EbTU0JJa1HEmrmgYZJkc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765935663; c=relaxed/simple; bh=8TyVSvKXYxR05iL0+NnYb0R4ktZ+w5a/caOd/UaYwpk=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=Xza7BOziv0qxYQLN3A35ZzAjy0Of04BS8YpcuLWgEu8Lnnd6egJS4d5uWNbhqKrVEEsx17tYeMZCQ8w9aLF5kYtdU54I9RlNsvw2OoxmLJHnehV5aE4SdUffiurbY+McQUAaNqtTM1hhVB8BAkkr1B1SiyrpyIsLcqj7bj5Rm/4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Zctc0A7l; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Zctc0A7l" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2a0abca9769so6524415ad.1 for ; Tue, 16 Dec 2025 17:41:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765935662; x=1766540462; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=mDxHcZkTjmjUFpD0nPdaDh+C7TB+4JYFvDaSUk+afn4=; b=Zctc0A7lyZ3TvRozNmzCOk6Ut3H6lHvT7WTfVdYkv6TGiHwfd3tajEnlHG9VFxhTmr 19LjuylpMNb7JsxsxnwMDyXNUIN1m/fwh7zf/I46bguaADrn6CHiiOxlmBnC8e5VLLjj m1AlUQJpLZCdrSGEYvNzGBOQ6t/U26yFpcUsWS2+Eqj0cdX5y8cB8ivewjI1PNX5UsDR 4FGm3NyNG0rN+vNOOpdepTGofVngIrc12F+VD0XfIH1GQCvXj6/Z9MSCUgoG+Y7/zhDW inaojLFQcoNpiPog5C+tPj9WmCAEb5djsEyodoN4akEwN6BnOmuoHAdk3OZZIhI5mOLX yR/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765935662; x=1766540462; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=mDxHcZkTjmjUFpD0nPdaDh+C7TB+4JYFvDaSUk+afn4=; b=GQ7AnLw6VNi9xeZXxwpzIo5iI3tXvhIcePtAy3yKn97voTrJaQKIFavureUShGL709 MoixR1x7J7ryvT5xc2OjnhLDhBlhvAT8RE44b7BIdf2hNhX+WxWUuenRQSh++PttycDF FS0pBd6XQtHXLUJ0qReU6XHcamqO7kOPUdMWOD5FWevN/j0nfreajUvEdd0dNMfZBKH0 jnqP+ohi4Apu5oKBJPg06IbX+8ne2fh0usbEKEGciY4+nWuCFW2FkTJTJ01p5KsWE7G+ OWKLQGDveY4eaJqKDdZtirNWNe/axFdja5lynSOT2b3f6d0NEfbD/SVFIVOkeYAK9fB7 lMsg== X-Forwarded-Encrypted: i=1; AJvYcCXKLYYt3P5XFboRe0hJtcHZ1cIxzVgYNyIm7nT8Oat/XNF3lohx9BXwnSj9NBBjZOKWu3d5o2VJsdx7Hs4=@vger.kernel.org X-Gm-Message-State: AOJu0YztBNZs2KvwTixDq5TXKPXLC9e6Z0KlyCVtXUEtQi/HFmTNmys9 K2SA/qApl8aaiJhJR3RB5djvxH8AHJLlCWc3tyoWLK/v5/GH1FCcDqpw X-Gm-Gg: AY/fxX5vRp8806LJbgci+4XaJnh519s98VzzLlTPVtohszZVgiMk5UY3qPZphCIoT/v ISuTbmOzhsTnosz/5KZz2XTJ8fRGecSFN72HvoAliODwySyvXMUeKaxiU7cJv7XICALrI3J+XdL upU9s7KZrBaHQGo+3C1cPiu2cCRQHLIy3wGzY0T1JXW+VJ7Bg9xgVdD/ty9jDcXgEm8tlMDNwHh r2NtOF1HjjANl7VMDCol3X5nuoN4yfjIq1C9OmxFv8/t76o/NbMOCNeSBVlsSOrwFsSnSz6RF1e nsezTYw5rtyMSfONZtsZHX21Zqy3Mdv232OkCdnJo+TL3RG2nWhd3SdRWRpIh77pLqoFHNPVr3m vT6UW7LLRCP8OReKrfugWdp8vPMU9pO7LS4LR7rGXgPuKYP1zUymW7jKYKvtVsdmYCiNsd/6Uci wcy7A71g+zv/wUMJWQHRs9Yl3/+ot3GvRqsBKKETyBt4ay4PIpQyHgo95BMO1oCbSaVtCKJdj1q 8IaWHcBi6A= X-Google-Smtp-Source: AGHT+IF/SEOxDOKcFv5IqFKvN9ywf362IPWc8RJF/t4t5MrZbneoibmeTII8xwlbnor44Kr5k43j5Q== X-Received: by 2002:a17:902:ce8b:b0:2a0:ccee:b356 with SMTP id d9443c01a7336-2a0cceebcddmr72318115ad.1.1765935661607; Tue, 16 Dec 2025 17:41:01 -0800 (PST) Received: from poi.localdomain (KD118158218050.ppp-bb.dion.ne.jp. [118.158.218.50]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29eea016f80sm179600095ad.60.2025.12.16.17.40.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Dec 2025 17:41:01 -0800 (PST) From: Qianchang Zhao To: Krzysztof Kozlowski , Paolo Abeni , Jakub Kicinski Cc: "David S. Miller" , Eric Dumazet , Simon Horman , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Zhitong Liu , Qianchang Zhao Subject: [PATCH] nfc: llcp: avoid double release/put on LLCP_CLOSED in nfc_llcp_recv_disc() Date: Wed, 17 Dec 2025 10:40:48 +0900 Message-Id: <20251217014048.16889-1-pioooooooooip@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nfc_llcp_sock_get() takes a reference on the LLCP socket via sock_hold(). In nfc_llcp_recv_disc(), when the socket is already in LLCP_CLOSED state, the code used to perform release_sock() and nfc_llcp_sock_put() in the CLOSED branch but then continued execution and later performed the same cleanup again on the common exit path. This results in refcount imbalance (double put) and unbalanced lock release. Remove the redundant CLOSED-branch cleanup so that release_sock() and nfc_llcp_sock_put() are performed exactly once via the common exit path, while keeping the existing DM_DISC reply behavior. Reported-by: Qianchang Zhao Reported-by: Zhitong Liu Cc: stable@vger.kernel.org Signed-off-by: Qianchang Zhao --- net/nfc/llcp_core.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index beeb3b4d2..ed37604ed 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1177,11 +1177,6 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local, nfc_llcp_socket_purge(llcp_sock); - if (sk->sk_state == LLCP_CLOSED) { - release_sock(sk); - nfc_llcp_sock_put(llcp_sock); - } - if (sk->sk_state == LLCP_CONNECTED) { nfc_put_device(local->dev); sk->sk_state = LLCP_CLOSED; -- 2.34.1