From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B8EA3DA5D9; Thu, 21 May 2026 14:33:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374029; cv=none; b=vBXVTEcQRk9T8egzQdP1gKzYS3MHQMNIpP64y4F/HfFV6btpi2EZsDBM01PMwWmvI1hhcXn9WntYd1B6DQGZXOL5DtwUhmrZDAkGgAD2XUx2BZsvRF6uIBieS309yE4gHQwW9JARqJaIdC2UnOjIYsr0/5UTbqqSVKV+KjmbRKM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779374029; c=relaxed/simple; bh=0f0JcxPSMeZgDLB8kRDPnqGxviBR5km7oxybzD3GN9g=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=gWIKdycTfBHlyDN7v9mL7ow+QM3oExHjSbjl2K5Dkns5gvwYnWZ+LadVu8rO81yNGl/h0BDKbyEIbO5NEWt9t9PAr6cwTfauUA6+3O0ANsyy8BVquLGkYmhfHApF2F+en8A7XzDduuxvL1/C/Gg9xJr9FZg6ICIAT+WJDIqk27Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=qiN4WNsM; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="qiN4WNsM" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:Content-Transfer-Encoding: Content-Type:MIME-Version:Message-Id:Date:Subject:From:Reply-To:Content-ID: Content-Description:In-Reply-To:References; bh=XtLHiW1Hy34yQSEJx/APJIZCCKJAzzXN1hrjcEjhY2I=; b=qiN4WNsMBjHyc0h9nLuTe/WusE xFB2dcNQeGuYBD/4Tu+g3ao2VQSZjyt2wcpeKus6HrjcEjy0zhUVDWQyhJ6c7CXwuoLCYnK1l0q38 epWhfczn7J/VT0BYM27jf3JmIHXVaXnbriiBH4NF/vReuX2mkArTve8Bl1CbiueiGCMm6zNO0PVh2 +EpynK8sjfvAgIEQ+7/hCaiaf4HBXRUyKYd8o5PTdJhuOeCTT727wpTECKzquOc1DwXU9hQadZLkl zFXBv3epLtpAbtQzqOd16lmsx+Wyi06FGxR0lBYvKEou8tPwQBRL+JEZkwKH2N7zmvGe4ni0IqUQI DlcImYqA==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wQ4Sj-003wwy-2e; Thu, 21 May 2026 14:33:26 +0000 From: Breno Leitao Subject: [PATCH net v2 0/2] nfc: llcp: two fixes for nfc_llcp_getsockopt() Date: Thu, 21 May 2026 07:32:08 -0700 Message-Id: <20260521-fix_llc-v2-0-ab44cc09179c@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAGgXD2oC/2XNQQqDMBCF4auEWZtikiZaV71HkaJxolMkSmLFI t69mC67ffx8b4eIgTBCxXYIuFKkyUPFZMbADo3vkVMHFQOZS5Nrobij7TmOlsvCXUulTSmUhoz BHNDRlqQHeFyg/o3x3b7QLqdxZgPFZQqf9LeKFP/Rq+CCK2UL425KOGfuHbbU+MsUeqiP4/gCJ rkU37YAAAA= X-Change-ID: 20260513-fix_llc-27f483568135 To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Shuah Khan , David Heidelberg , Samuel Ortiz Cc: linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, oe-linux-nfc@lists.linux.dev, Breno Leitao , kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=2065; i=leitao@debian.org; h=from:subject:message-id; bh=0f0JcxPSMeZgDLB8kRDPnqGxviBR5km7oxybzD3GN9g=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqDxex3+o5dACgpZfaTA1duJ7LARDnjXI3wTfza x/DgZ+u01CJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCag8XsQAKCRA1o5Of/Hh3 bbC9D/90dmmzwrhVUlBQUjsTiCfv78Tn6nJ3evWXaQaYB7Y7mGQoSy/NKmmakXachDOaGd3rkwK H6hpyVJ2wHF2HWkk5M+ZFqvjbDGGGWn28ETJgThjqpFdHnHAMHAvM+SYQgVYMNPmzPMHDNqj7GP ET3IcbPa7fUksNxaD1MXBq0bwtQjsJ7XtUTTgPFXUmCOxCd9qQuJLzWLJy7ilYEmWcATe1rrDL2 p4+NISh68mF6Ze4bRLDhpT2guix/jJrw0rmDGRqM/9TDVEVkwoA430MiNANoy1w7L/JxQAaCoEZ ovrgyz7IsytTCOUtNVZdtTCWGMO1Zb/ByJCjhhpgQqelJUCo+PO3okxdbEyTc6Ct/BHZ8rPJg6T w4hyE1wwHHvZc+dUj/NkmbsexENqG6kt3WvX6aMC8KkIdUIRkggFFUPwsvKTNQLbhGEGflzFynr U/jZzxNhFqepT9LC3eVE4E0Z50GVPU+aC33zGXn3ARcUWlP1S3LU183Wl1NDKPAnv0cu+x2BwLb l/U/rejB/JuBaIiLah71rSVYeoIS2nUliMH+SbBTayj6FrJ78f0NfADX2l/VeVZ/HGdlrQLqqaf E4lP3/tepZKGFTX02cCvCerZKJpGczX7Ryj61cMOttficTwMipuqfTGgK346IguqUbU2Xw4/qK9 F0CUiEjK2gGDrpw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao While converting the NFC LLCP socket layer to the new getsockopt_iter() API, I noticed that nfc_llcp_getsockopt() unconditionally stores four bytes through a (u32 __user *) cast regardless of the caller-supplied optlen, overflowing the user buffer when optlen < 4. Patch 1 adds an explicit length check (with a signed-int guard so a negative optlen cannot slip past it) and is what I originally sent as v1. While reviewing v1, Simon/sashiko[1] pointed out that llcp_sock->local is read outside lock_sock(sk) and can be freed by a concurrent llcp_sock_bind() error path before getsockopt() dereferences it. Patch 2 moves the load and the NULL check inside the lock. Both fixes target the same original commit, so they are now sent together as a two-patch series. Note: These fixes were compile-tested. [1] https://lore.kernel.org/all/20260513-fix_llc-v1-1-33c76f931ff6@debian.org/ Signed-off-by: Breno Leitao --- Changes in v2: - Guard the length check against negative optlen (Simon Horman / sashiko). - Add patch 2: move llcp_sock->local read inside lock_sock(sk) to close a UAF race with llcp_sock_bind() (Simon Horman / sashiko). - Link to v1: https://patch.msgid.link/20260513-fix_llc-v1-1-33c76f931ff6@debian.org To: David Heidelberg To: "David S. Miller" To: Eric Dumazet To: Jakub Kicinski To: Paolo Abeni To: Simon Horman To: Samuel Ortiz Cc: oe-linux-nfc@lists.linux.dev Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- Breno Leitao (2): nfc: llcp: avoid userspace overflow on invalid optlen nfc: llcp: read llcp_sock->local under the socket lock in getsockopt net/nfc/llcp_sock.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- base-commit: 1d5dcaa3bd65f2e8c9baa14a393d3a2dc5db7524 change-id: 20260513-fix_llc-27f483568135 Best regards, -- Breno Leitao