[PATCH] nfc: nfcmrvl: fix null pointer dereference in nfcmrvl_bulk_complete

[PATCH] nfc: nfcmrvl: fix null pointer dereference in nfcmrvl_bulk_complete

[Joshua Crofts]

A race condition in the current implementation can cause a null pointer
dereference. When nfcmrvl_nci_register_dev() calls nci_register_device(),
the NCI device is immediately exposed to userspace. If userspace brings
up the device before probe() finishes assigning drv_data->priv,
submitted bulk URBs can complete while priv is still NULL.

Additionally, nfcmrvl_bulk_complete() incorrectly checked
NFCMRVL_NCI_RUNNING on drv_data->flags instead of drv_data->priv->flags.

Fix this by adding a NULL check and testing NFCMRVL_NCI_RUNNING on
drv_data->priv->flags before processing the completed URB.

Fixes: f26e30cc6b50 ("NFC: nfcmrvl: Initial commit for Marvell NFC driver")
Reported-by: syzbot+59d5e6a8ed04e6a000c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=59d5e6a8ed04e6a000c8
Tested-by: syzbot+59d5e6a8ed04e6a000c8@syzkaller.appspotmail.com
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
---
 drivers/nfc/nfcmrvl/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
index c7f2afe00b93..c22d783718fe 100644
--- a/drivers/nfc/nfcmrvl/usb.c
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -61,7 +61,7 @@ static void nfcmrvl_bulk_complete(struct urb *urb)
 	dev_dbg(&drv_data->udev->dev, "urb %p status %d count %d\n",
 		urb, urb->status, urb->actual_length);
 
-	if (!test_bit(NFCMRVL_NCI_RUNNING, &drv_data->flags))
+	if (!drv_data->priv || !test_bit(NFCMRVL_NCI_RUNNING, &drv_data->priv->flags))
 		return;
 
 	if (!urb->status) {
-- 
2.47.3

Re: [PATCH] nfc: nfcmrvl: fix null pointer dereference in nfcmrvl_bulk_complete

[Joshua Crofts]

On Mon, 31 Aug 2026 10:41:10 +0000
Joshua Crofts <joshua.crofts1@gmail.com> wrote:

> A race condition in the current implementation can cause a null pointer
> dereference. When nfcmrvl_nci_register_dev() calls nci_register_device(),
> the NCI device is immediately exposed to userspace. If userspace brings
> up the device before probe() finishes assigning drv_data->priv,
> submitted bulk URBs can complete while priv is still NULL.
> 
> Additionally, nfcmrvl_bulk_complete() incorrectly checked
> NFCMRVL_NCI_RUNNING on drv_data->flags instead of drv_data->priv->flags.
> 
> Fix this by adding a NULL check and testing NFCMRVL_NCI_RUNNING on
> drv_data->priv->flags before processing the completed URB.
> 
> Fixes: f26e30cc6b50 ("NFC: nfcmrvl: Initial commit for Marvell NFC driver")
> Reported-by: syzbot+59d5e6a8ed04e6a000c8@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=59d5e6a8ed04e6a000c8
> Tested-by: syzbot+59d5e6a8ed04e6a000c8@syzkaller.appspotmail.com
> Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
> ---
>  drivers/nfc/nfcmrvl/usb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
> index c7f2afe00b93..c22d783718fe 100644
> --- a/drivers/nfc/nfcmrvl/usb.c
> +++ b/drivers/nfc/nfcmrvl/usb.c
> @@ -61,7 +61,7 @@ static void nfcmrvl_bulk_complete(struct urb *urb)
>  	dev_dbg(&drv_data->udev->dev, "urb %p status %d count %d\n",
>  		urb, urb->status, urb->actual_length);
>  
> -	if (!test_bit(NFCMRVL_NCI_RUNNING, &drv_data->flags))
> +	if (!drv_data->priv || !test_bit(NFCMRVL_NCI_RUNNING, &drv_data->priv->flags))
>  		return;
>  
>  	if (!urb->status) {

Hi David,

gentle ping on this patch.

-- 
Kind regards,
Joshua Crofts