From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f44.google.com (mail-qv1-f44.google.com [209.85.219.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E036B24676D for ; Mon, 13 Jul 2026 01:22:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783905770; cv=none; b=U5p2uroeG+cgoEJKJDqE8QrxAKS4qO/QBGQ34jWvwFNSh9dn5jBD2aKILYWwywYAGFVygWEVgUbrnwkcVB9PLaWdrKV3bkdiQUVxmYPdMyJFDNQp1G5jmVQNY6kdQEzMkq7MHMRnZtlto69pPYfQkOxai9ELE9m70NFVw7DcI6Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783905770; c=relaxed/simple; bh=r68fvNfyB5iq5zgmcYtQh4f4Sqo7v+mUf0FuLyud6fI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fvLO2ThHm4msfGq1WmZy4W77P3o6sgj7jxyyZdoYHpAib7xv1ORbTMLVqKBbgD0LkE0Hc1blAI/8mljpgtYYPU0kGrmaXdZHh0UHi6kPuGkJkPzPz4S79f/+4A+HP26H6/mU1HIwV0vHeehqptOnx1fE0tUouxobuFzq9MW7PjA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=J3YeyoM1; arc=none smtp.client-ip=209.85.219.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="J3YeyoM1" Received: by mail-qv1-f44.google.com with SMTP id 6a1803df08f44-8ef1dc934d1so24213756d6.0 for ; Sun, 12 Jul 2026 18:22:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783905767; x=1784510567; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=NTLeZyR0HQahPotCRM69u6fZXEm2pgRfmSKzmsE+130=; b=J3YeyoM1w+6qxDuYW43WQT4HAXKqRE5ettOOO6O4AWpdSWrJUqNDX8NRabrHbapzrW YCPgqiQJZe0Sltd2ORUggUwSgXpjIGaZhfOAfzBzbMAfcDP9+C8gWDTK6FpQeGkuha9M 4rc8ywj1QWcTb6NTlwsaDKvmn02gJfUTS+oLu+FnbDt1aenvwgjiZUr8ImyCbbh3Iy2c 5AzBGhlAdz1GyQ54UWp5nWJ+JpKLw/0RErzDI1ZPkZoOca4MdJQCYgclC1Rpae4Jaefd PQmuQeBkjDKbldd3N1LzBoVHD1Ni/onM+hJ8KDWDqZYoN8GTkVpzA+Si4MHd1I+A+ufr BRKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783905767; x=1784510567; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NTLeZyR0HQahPotCRM69u6fZXEm2pgRfmSKzmsE+130=; b=CO2s7VCnsdCXeVVTvkOBPRj6XJNo8MNR5mRAt6Q5MxnzGzXmb9T8jZLvtWG2if8mqg j62zccN9qs6yukjx53XDsPAJmi0WYfW0akuFER9kKX1nofjcQoVUBB+iqmZiUrraR57H 4Z7yDbWJFzCM9/tVmmY7IyunGTQhAgkGPncxkY/HLidT8QYmpH4SqMhXzrMhfSW0ZSP0 nISYm3xYqNf5+1sS72VRvMXZ+adaS+TubSYiSEnElHaLnbgFySZWrp0DfClddX2ojPB1 3QMwdXt7eCUaZlXTHypV4MIx2dEyZx00iNDkG8sP6/5JGiz/OeD3nIf8G/4mENhltGfu m8Vg== X-Forwarded-Encrypted: i=1; AHgh+RpUK+VF1+RmqogQtl7Prxl/iho5DfWH7Gps7S7qSs23y4JJhqT8c6a+hqbFDFe+YnANIX4eqxvlajl3A/4=@vger.kernel.org X-Gm-Message-State: AOJu0Yz4hIzCvIsUNXHFq+uWSSMuv588cBFnAF+EIUSH+pynQkApApUD CVfk2fMvM9alMcnoDbXI4mC+78b8+miQRcCeM2VgVoNIbF+1U+SDmn46 X-Gm-Gg: AfdE7clvJT0t3WDkKZkyLdReb1OH0AAxx9I0QkQupHBTVRqWSRAdT6asGATT20vHMvg PK/76tgJqtsfw2yyzB9nyf/GIULJ0kFfG/luYVMjs9sLCATBZKYf2nVXIpQKZw0Y0CQZ3Xk3UXl pJLMqLw2EsQAU6crg0ect2SKcynkmbNg7TO0LccH6QvwRi9BYf2DQw612eCcdTMzieXqf8MQzIL 1zvKWM/h1wUTLKFeduUY6cJoNRXeF+1N69YfgqSc2vzcNsPZnQ0x6/TMgc/KKKNJXrSwqSIah1q nIfXi8GNWXfTSApZLRJaWmfjt1txGuVBgcPMBjr+c6RFfJC3sV9akfwIyIMOrhET6foTIQoaDxg 89KZZCgoC0bcL2Rl7OsDxfQ7Y0OStdLql1+Y5K65Yxxp4gRfZxkrzkiGqkhq2uocZPrgfM71Tqt NFWN56IvFosK/oMB4NVpSE9EQO1rfEdEBKBThNx0JRGw== X-Received: by 2002:a0c:f119:0:b0:8e5:8d7b:5188 with SMTP id 6a1803df08f44-902351409fbmr120041846d6.9.1783905766785; Sun, 12 Jul 2026 18:22:46 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ffd87cad3csm117151996d6.48.2026.07.12.18.22.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 18:22:46 -0700 (PDT) From: Shuangpeng Bai To: David Heidelberg Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Samuel Ortiz , oe-linux-nfc@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Shuangpeng Bai Subject: [PATCH net] nfc: llcp: Fix raw socket local ref leak on rebind Date: Sun, 12 Jul 2026 21:21:11 -0400 Message-ID: <20260713012111.4066423-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Raw LLCP sockets own the reference returned by nfc_llcp_find_local(). When the bound NFC device is unregistered, nfc_llcp_socket_release() sets raw sockets back to LLCP_CLOSED. It also unlinks them from local->raw_sockets, but leaves llcp_sock->local pointing at that local. A subsequent successful bind on the same socket gets a new local reference and overwrites llcp_sock->local. The old local reference is then lost, and the final socket release only drops the new local. Drop any stale local reference after the new target local has been found, but before overwriting llcp_sock->local. This keeps failed bind attempts from changing the old reference while preventing a successful rebind from leaking it. Fixes: e6a3a4bb856a ("NFC: llcp: Clean raw sockets from nfc_llcp_socket_release") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- net/nfc/llcp_sock.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index feab29fc6..0c00cdaab 100644 --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -152,6 +152,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr_unsized *addr struct sock *sk = sock->sk; struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk); struct nfc_llcp_local *local; + struct nfc_llcp_local *old_local; struct nfc_dev *dev; struct sockaddr_nfc_llcp llcp_addr; int len, ret = 0; @@ -185,6 +186,11 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr_unsized *addr goto put_dev; } + old_local = llcp_sock->local; + llcp_sock->local = NULL; + llcp_sock->dev = NULL; + nfc_llcp_local_put(old_local); + llcp_sock->dev = dev; llcp_sock->local = local; llcp_sock->nfc_protocol = llcp_addr.nfc_protocol; -- 2.43.0