[PATCH] nfc: llcp: Fix local use-after-free in nfc_llcp_general_bytes()

[PATCH] nfc: llcp: Fix local use-after-free in nfc_llcp_general_bytes()

[Wentao Liang]

nfc_llcp_general_bytes() drops the reference on the llcp local structure
with nfc_llcp_local_put() and then still reads local->gb for the return
value. If that was the last reference, the local structure is freed and
the read happens on freed memory.

Capture the pointer to the general bytes before dropping the reference
so the local structure is no longer used after the put.

Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/nfc/llcp_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index db5bc6a878dd..d0f17fbacfee 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -638,6 +638,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
 u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 {
 	struct nfc_llcp_local *local;
+	u8 *gb;
 
 	local = nfc_llcp_find_local(dev);
 	if (local == NULL) {
@@ -648,10 +649,11 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 	nfc_llcp_build_gb(local);
 
 	*general_bytes_len = local->gb_len;
+	gb = local->gb;
 
 	nfc_llcp_local_put(local);
 
-	return local->gb;
+	return gb;
 }
 
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
-- 
2.34.1

Re: [PATCH] nfc: llcp: Fix local use-after-free in nfc_llcp_general_bytes()

[Simon Horman]

+ Ren Wei

On Thu, Sep 17, 2026 at 04:38:36PM +0000, Wentao Liang wrote:
> nfc_llcp_general_bytes() drops the reference on the llcp local structure
> with nfc_llcp_local_put() and then still reads local->gb for the return
> value. If that was the last reference, the local structure is freed and
> the read happens on freed memory.
> 
> Capture the pointer to the general bytes before dropping the reference
> so the local structure is no longer used after the put.
> 
> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

I believe this duplicates a more comprehensive approach by Ren Wei:
- [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks
  https://lore.kernel.org/all/006437e618b55acc0df69d94255244a490b11461.1786029423.git.rakukuip@gmail.com/

Please check prior work before posting patches.

> ---
>  net/nfc/llcp_core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index db5bc6a878dd..d0f17fbacfee 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -638,6 +638,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
>  u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
>  {
>  	struct nfc_llcp_local *local;
> +	u8 *gb;
>  
>  	local = nfc_llcp_find_local(dev);
>  	if (local == NULL) {
> @@ -648,10 +649,11 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
>  	nfc_llcp_build_gb(local);
>  
>  	*general_bytes_len = local->gb_len;
> +	gb = local->gb;
>  
>  	nfc_llcp_local_put(local);
>  
> -	return local->gb;
> +	return gb;
>  }
>  
>  int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
> -- 
> 2.34.1
>