From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54C2E34B1AC for ; Wed, 17 Dec 2025 12:58:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765976288; cv=none; b=siloYrkpc5rkNrowT0MUDtQ6u6DDpvpZa2FFwMUbxOpatWYMvpzkVhbrR9TQpSrkfZOH6qpqnZvyxnd4K1YfGyK/saKuQbDPplLN8soTwX2WtuUpDF6r0FW7ce8PUSEWgHBTJ8h1XDaVAVnBUpYsuxroRoDXWo1RKnUtUWJtyRc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765976288; c=relaxed/simple; bh=SZnCdTyKaSLAbq/w5ae+5W9P3TCfTqARU6rrGxRItYg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=mntokwhcFWOOeQGP5J6KAEYvGHlCi7hOeEXzwOtQmGeb507dymd8oy/Areixjy4kCJBr5JapcqV19c+UEFsYiIhschcrasU9LX7ZJGejgOoZtoiGFC6MvldTrb1HpgmzGpjNVSTEUcpdWnxaiCHIxI6xfEWMV7FSCiW3ryIKftc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YkZMk3Rf; arc=none smtp.client-ip=209.85.210.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YkZMk3Rf" Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-7f6282195a9so503155b3a.2 for ; Wed, 17 Dec 2025 04:58:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765976283; x=1766581083; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=19nxpEKwGS7FQgHQH9ItvDMFClxV8pWJ4CiL9LfKCs0=; b=YkZMk3Rf8izIZxEypeYZRidmU0DRh26aCOQdpNYkAJR5mf8MvE85JHAugxt+0oW4Th ess1vSGrfjA4QpvytxbUmIH0Zz4X/Xk2ei2edGtd4d7rjGgZdFEViQwPUStyJQFe7oGE WHHojGbQ1ux3IWz7XzFbgN6L85YgZAMy5jK6rVmIYQOoOMwPv3uUb6I2cVpihF8Jqn32 vCGzXfawokhnUjt8roT4qDLEPcI25azrhRtZavDi6Y7b8T4/wj7yuBhEGv7+8XNahwid /uvxeV26d+58ms5GUQfrNtbn9j57mb0+IoIL+WODETwpauyhRXw/kyh4y6qsc9OE7cOt RVcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765976283; x=1766581083; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=19nxpEKwGS7FQgHQH9ItvDMFClxV8pWJ4CiL9LfKCs0=; b=MGcASWRXQRXL/ZGBiW3gED1gsnxMB+DQ5ckMp040LorXkwJBFjWaeKIk7xRCuiThzn 6KHbHL40+VCbvqocQC1u6MrIeb1EcEtoWv4U79W+zoDYDpMtMr5dUlOmsomBrf0EmEyP s8GwmK6L68ICJo4Iq9dodbTbHzvZs35ha0/pLmOK3oKt2mYi7AmlL50Z5cfNnJMGtE+z gEzhqlaoGXrW0VMBQzeSmPxsPyPVj9DEkW9EE7e0ifllgioWsUDjWMQKnvB95NeIoA+K EggzJmZ8zHGQTOWdQ9evGoORgm/QB1n9ZCDZLzE0q/g5/d2VIh3vmLqRBxZ9hgronkQS /D1Q== X-Gm-Message-State: AOJu0YzEDDiolE4pDIk0bhXUlIjMWKjYc7wkpoXOWFPPNXjXoaWQY7kC 3lBCF4Rg0pxDCWnUnyzCx8ev5Fe0DFzCda5MsbWQYOkpxreTT8GL/kfhfS/Cjfuw X-Gm-Gg: AY/fxX6jkaKywsCx0+MoZL5RYAbz54Hwypgj7xng6nPTa3GE2PKsYlkda7bwxNh6Sjd x8ZLs3dHNJy9a6tTD1qOwoWw94yMjZAGJ4dfkjdzyW0wa+uEdLB6AVLaebyUrMb6mywJqFcvtXj QzbPcqm2kAjQpsb36scJqMJyJjh2nUmGHYe8sPtovEgsl8QXnWktLpxjH6NRJ2kEH07E9ekFizd 43jOmKe8VliTaOF2Uv+EaToUhwXO37iycLcf/G6VSVJXoOjGfRTiBxe8kl6BxW2BfEnEwWLsX0X GL5rotgNFJs7cWQSbNM8TMNnxs62k5M4PI8lbLg0zWkv2LxT/GBzYC+5Lxdkwos8D3GEtyIgD4L YbK8DIIOX3D/oLBXMtHmtvkrDL8eE9/a2j3SfTiIUIe/xkuN1rA/2eY96QXx352pPerzsgD4wwv ti8ap2krA4R/DbOG5of486gGu46C+3XsSV5rH7BXVFGrxEiy+MlHS6Xp+SQG29gFT+Y/n5roLBR weBS7RMTNU= X-Google-Smtp-Source: AGHT+IGljT05kcE0gnGjJhZSXdc45btqsT9idbNMlheRL+reQ+D2Cuw4RN6rf32Fhx0ASJ9iIYpshg== X-Received: by 2002:a05:6a00:929b:b0:7ab:9850:25fb with SMTP id d2e1a72fcca58-7f667731a61mr12221010b3a.2.1765976283395; Wed, 17 Dec 2025 04:58:03 -0800 (PST) Received: from poi.localdomain (KD118158218050.ppp-bb.dion.ne.jp. [118.158.218.50]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7fd974aeb37sm839335b3a.11.2025.12.17.04.58.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Dec 2025 04:58:02 -0800 (PST) From: Qianchang Zhao To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Krzysztof Kozlowski , Paolo Abeni , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Simon Horman , stable@vger.kernel.org, Qianchang Zhao Subject: [PATCH v2 1/2] nfc: llcp: avoid double release/put on LLCP_CLOSED in nfc_llcp_recv_disc() Date: Wed, 17 Dec 2025 21:57:45 +0900 Message-Id: <20251217125746.19304-2-pioooooooooip@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20251217125746.19304-1-pioooooooooip@gmail.com> References: <20251217125746.19304-1-pioooooooooip@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit nfc_llcp_sock_get() takes a reference on the LLCP socket via sock_hold(). In nfc_llcp_recv_disc(), when the socket is already in LLCP_CLOSED state, the code used to perform release_sock() and nfc_llcp_sock_put() in the CLOSED branch but then continued execution and later performed the same cleanup again on the common exit path. This results in refcount imbalance (double put) and unbalanced lock release. Remove the redundant CLOSED-branch cleanup so that release_sock() and nfc_llcp_sock_put() are performed exactly once via the common exit path, while keeping the existing DM_DISC reply behavior. Fixes: d646960f7986fefb460a2b062d5ccc8ccfeacc3a ("NFC: Initial LLCP support") Cc: stable@vger.kernel.org Signed-off-by: Qianchang Zhao --- net/nfc/llcp_core.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index beeb3b4d2..ed37604ed 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1177,11 +1177,6 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local, nfc_llcp_socket_purge(llcp_sock); - if (sk->sk_state == LLCP_CLOSED) { - release_sock(sk); - nfc_llcp_sock_put(llcp_sock); - } - if (sk->sk_state == LLCP_CONNECTED) { nfc_put_device(local->dev); sk->sk_state = LLCP_CLOSED; -- 2.34.1