From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from ixit.cz (ixit.cz [84.42.129.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 39851369D76; Tue, 11 Aug 2026 18:31:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=84.42.129.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786473091; cv=none; b=YUkdSWTmDLSkK/1dkNIpDTwxE4AB3gQ/BCfNwDgkzazL9ogNKpILwovfXGuX1FP/imD6Vhv1//+EwLercFNavcX1X1xUDgGl9OSOJgqCfIgJU/6YDJQRnv1BXAYPpHZWzEwb7qvT2jBPTvQG+hAQeRrrlHoqsf4eUjZATFr9SyU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786473091; c=relaxed/simple; bh=Vo4Z3aUxM4tTHTF/z556wLMnLFj0u9fFoCoJ1zeiNhc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=rF3i3Kv9TX/KALXO852JKlElgl0pFOOO83bpX/q+sOIDJ6WQlwKHGhmDfUlH+dQIHIRaFKG0jNAOFFUEMpF1aWVl+jFKkMxlTtxfz++f5YDz56flmVul19K//wi3GMm3qt9rElKhjezUOmNxlpcuL08UrDlXPcwfNIjbROSEu1E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=ixit.cz; spf=pass smtp.mailfrom=ixit.cz; dkim=pass (1024-bit key) header.d=ixit.cz header.i=@ixit.cz header.b=zfCNJgqO; arc=none smtp.client-ip=84.42.129.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=ixit.cz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ixit.cz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ixit.cz header.i=@ixit.cz header.b="zfCNJgqO" Received: from [10.0.0.152] (unknown [10.0.0.1]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange x25519) (No client certificate requested) by ixit.cz (Postfix) with ESMTPSA id 2FF9953406F4; Tue, 11 Aug 2026 20:31:27 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ixit.cz; s=dkim; t=1786473087; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=30y1Ndtt2pEAUgoeW88Dp+uTXv0eUW/Kz+uRzJE95tE=; b=zfCNJgqOvOApZRF+wiZrKukRZJ42umrNrp/zL1hg0vxeWatodDDTlabkENmkWsVZ2VMGT4 Hw8vb3S84Fo3BwKwcrUiS4xAIa/Eql2mzTJdJIJyHu7GowcG2yc/S9Sjc6S2jVthvj7N6W GQFK/2c0qEYFcTwppdYke3KFGToYQIM= Message-ID: <2d2b72ad-2aac-43f6-8f47-72b2fc148192@ixit.cz> Date: Tue, 11 Aug 2026 20:31:27 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] nfc: llcp: fix NULL pointer dereference race in nfc_llcp_send_ui_frame() To: Junwoong Doh Cc: "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Krzysztof Kozlowski , oe-linux-nfc@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260725115556.1250160-1-jdoh.kernel@gmail.com> Content-Language: en-US From: David Heidelberg Autocrypt: addr=david@ixit.cz; keydata= xsFNBF5v1x4BEADS3EddwsNsvVAI1XF8uQKbdYPY/GhjaSLziwVnbwv5BGwqB1tfXoHnccoA 9kTgKAbiXG/CiZFhD6l4WCIskQDKzyQN3JhCUIxh16Xyw0lECI7iqoW9LmMoN1dNKcUmCO9g lZxQaOl+1bY/7ttd7DapLh9rmBXJ2lKiMEaIpUwb/Nw0d7Enp4Jy2TpkhPywIpUn8CoJCv3/ 61qbvI9y5utB/UhfMAUXsaAgwEJyGPAqHlC0YZjaTwOu+YQUE3AFzhCbksq95CwDz4U4gdls dmv9tkATfu2OmzERZQ6vJTehK0Pu4l5KmCAzYg42I9Dy4E6b17x6NncKbcByQFOXMtG0qVUk F1yeeOQUHwu+8t3ZDMBUhCkRL/juuoqLmyDWKMc0hKNNeZ9BNXgB8fXkRLWEUfgDXsFyEkKp NxUy5bDRlivf6XfExnikk5kj9l2gGlNQwqROti/46bfbmlmc/a2GM4k8ZyalHNEAdwtXYSpP 8JJmlbQ7hNTLkc3HQLRsIocN5th/ur7pPMz1Beyp0gbE9GcOceqmdZQB80vJ01XDyCAihf6l AMnzwpXZsjqIqH9r7T7tM6tVEVbPSwPt4eZYXSoJijEBC/43TBbmxDX+5+3txRaSCRQrG9dY k3mMGM3xJLCps2KnaqMcgUnvb1KdTgEFUZQaItw7HyRd6RppewARAQABzSBEYXZpZCBIZWlk ZWxiZXJnIDxkYXZpZEBpeGl0LmN6PsLBlAQTAQgAPgIbAwULCQgHAgYVCgkICwIEFgIDAQIe AQIXgBYhBNd6Cc/u3Cu9U6cEdGACP8TTSSByBQJl+KksBQkPDaAOAAoJEGACP8TTSSBy6IAQ AMqFqVi9LLxCEcUWBn82ssQGiVSDniKpFE/tp7lMXflwhjD5xoftoWOmMYkiWE86t5x5Fsp7 afALx7SEDz599F1K1bLnaga+budu55JEAYGudD2WwpLJ0kPzRhqBwGFIx8k6F+goZJzxPDsf loAtXQE62UvEKa4KRRcZmF0GGoRsgA7vE7OnV8LMeocdD3eb2CuXLzauHAfdvqF50IfPH/sE jbzROiAZU+WgrwU946aOzrN8jVU+Cy8XAccGAZxsmPBfhTY5f2VN1IqvfaRdkKKlmWVJWGw+ ycFpAEJKFRdfcc5PSjUJcALn5C+hxzL2hBpIZJdfdfStn+DWHXNgBeRDiZj1x6vvyaC43RAb VXvRzOQfG4EaMVMIOvBjBA/FtIpb1gtXA42ewhvPnd5RVCqD9YYUxsVpJ9d+XsAy7uib3BsV W2idAEsPtoqhVhq8bCUs/G4sC2DdyGZK8MRFDJqciJSUbqA+5z1ZCuE8UOPDpZKiW6H/OuOM zDcjh0lOzr4p+/1TSg1PbUh7fQ+nbMuiT044sC1lLtJK0+Zyn0GwhR82oNM4fldNsaHRW42w QGD35+eNo5Pvb3We5XRMlBdhFnj7Siggp4J8/PJ6MJvRyC+RIJPGtbdMB2/RxWunFLn87e5w UgwR9jPMHAstuTR1yR23c4SIYoQ2fzkrRzuazsFNBF5v1x4BEADnlrbta2WL87BlEOotZUh0 zXANMrNV15WxexsirLetfqbs0AGCaTRNj+uWlTUDJRXOVIwzmF76Us3I2796+Od2ocNpLheZ 7EIkq8budtLVd1c06qJ+GMraz51zfgSIazVInNMPk9T6fz0lembji5yEcNPNNBA4sHiFmXfo IhepHFOBApjS0CiOPqowYxSTPe/DLcJ/LDwWpTi37doKPhBwlHev1BwVCbrLEIFjY0MLM0aT jiBBlyLJaTqvE48gblonu2SGaNmGtkC3VoQUQFcVYDXtlL9CVbNo7BAt5gwPcNqEqkUL60Jh FtvVSKyQh6gn7HHsyMtgltjZ3NKjv8S3yQd7zxvCn79tCKwoeNevsvoMq/bzlKxc9QiKaRPO aDj3FtW7R/3XoKJBY8Hckyug6uc2qYWRpnuXc0as6S0wfek6gauExUttBKrtSbPPHiuTeNHt NsT4+dyvaJtQKPBTbPHkXpTO8e1+YAg7kPj3aKFToE/dakIh8iqUHLNxywDAamRVn8Ha67WO AEAA3iklJ49QQk2ZyS1RJ2Ul28ePFDZ3QSr9LoJiOBZv9XkbhXS164iRB7rBZk6ZRVgCz3V6 hhhjkipYvpJ/fpjXNsVL8jvel1mYNf0a46T4QQDQx4KQj0zXJbC2fFikAtu1AULktF4iEXEI rSjFoqhd4euZ+QARAQABwsF8BBgBCAAmAhsMFiEE13oJz+7cK71TpwR0YAI/xNNJIHIFAmX4 qVAFCQ8NoDIACgkQYAI/xNNJIHKN4A/+Ine2Ii7JiuGITjJkcV6pgKlfwYdEs4eFD1pTRb/K 5dprUz3QSLP41u9OJQ23HnESMvn31UENk9ffebNoW7WxZ/8cTQY0JY/cgTTrlNXtyAlGbR3/ 3Q/VBJptf04Er7I6TaKAmqWzdVeKTw33LljpkHp02vrbOdylb4JQG/SginLV9purGAFptYRO 8JNa2J4FAQtQTrfOUjulOWMxy7XRkqK3QqLcPW79/CFn7q1yxamPkpoXUJq9/fVjlhk7P+da NYQpe4WQQnktBY29SkFnvfIAwqIVU8ix5Oz8rghuCcAdR7lEJ7hCX9bR0EE05FOXdZy5FWL9 GHvFa/Opkq3DPmFl/0nt4HJqq1Nwrr+WR6d0414oo1n2hPEllge/6iD3ZYwptTvOFKEw/v0A yqOoYSiKX9F7Ko7QO+VnYeVDsDDevKic2T/4GDpcSVd9ipiKxCQvUAzKUH7RUpqDTa+rYurm zRKcgRumz2Tc1ouHj6qINlzEe3a5ldctIn/dvR1l2Ko7GBTG+VGp9U5NOAEkGpxHG9yg6eeY fFYnMme51H/HKiyUlFiE3yd5LSmv8Dhbf+vsI4x6BOOOq4Iyop/Exavj1owGxW0hpdUGcCl1 ovlwVPO/6l/XLAmSGwdnGqok5eGZQzSst0tj9RC9O0dXO1TZocOsf0tJ8dR2egX4kxM= In-Reply-To: <20260725115556.1250160-1-jdoh.kernel@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 25/07/2026 13:55, Junwoong Doh wrote: > nfc_llcp_send_ui_frame() checks whether sock->local is NULL, but it is > called by llcp_sock_sendmsg() without the socket lock held, which opens > a window for a race condition. Between the sock->local check and the > sock->dev use in nfc_alloc_send_skb(), llcp_sock_bind() can run > concurrently and set both sock->local and sock->dev to NULL, which can > lead to a NULL pointer dereference in nfc_alloc_send_skb(). > > Take the socket lock in nfc_llcp_send_ui_frame() so that the sock->local > check and the sock->dev use are performed under it. The message is > copied from user space before the lock is taken, to avoid holding the > lock across a user space access that can block for an unbounded amount > of time. > > Fixes: dded08927ca3 ("nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind()") > Signed-off-by: Junwoong Doh > Link: https://lore.kernel.org/all/a89d0419-8bcf-40a2-b52d-3e5d911f11da@gmail.com/ > --- > net/nfc/llcp_commands.c | 17 ++++++++++++----- > 1 file changed, 12 insertions(+), 5 deletions(-) > Hello Junwoong, it seems Sashiko noted an issue, could you verify it please (see below, feel free to ignore the pre-existing one)? Thanks David --- Patch [1]: [PATCH net] nfc: llcp: fix NULL pointer dereference race in nfc_llcp_send_ui_frame() --- commit 9c4c4bdf57043772ddc74843af1f533e7e9bc0ca Author: Junwoong Doh nfc: llcp: fix NULL pointer dereference race in nfc_llcp_send_ui_frame() This patch fixes a race condition in nfc_llcp_send_ui_frame() where concurrent bind() calls can lead to a NULL pointer dereference. It moves the allocation and socket state checks inside the socket lock. Link: https://lore.kernel.org/all/a89d0419-8bcf-40a2-b52d-3e5d911f11da@gmail.com/ > diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c > index 291f26facbf3a..cfd5f6aebf8df 100644 > --- a/net/nfc/llcp_commands.c > +++ b/net/nfc/llcp_commands.c [ ... ] > @@ -763,7 +769,7 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, > pr_debug("Fragment %zd bytes remaining %zd", > frag_len, remaining_len); > > - pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0, > + pdu = nfc_alloc_send_skb(sock->dev, sk, 0, > frag_len + LLCP_HEADER_SIZE, &err); Since the lock_sock(sk) critical section now covers this entire loop, could calling nfc_alloc_send_skb() with a hardcoded flags value of 0 cause an uninterruptible sleep deadlock? When the socket's write buffer is full, sock_alloc_send_skb() will invoke sock_wait_for_wmem() to sleep until memory is available. For datagram sockets, this function does not drop the socket lock while sleeping. Concurrently, any other operations needing the socket lock (such as close() calling llcp_sock_release) might hang in a D-state indefinitely until the send buffer drains. > if (pdu == NULL) { > pr_err("Could not allocate PDU (error=%d)\n", err); > len -= remaining_len; This is a pre-existing issue, but does the exact same race condition remain unpatched in nfc_llcp_send_i_frame()? In nfc_llcp_send_i_frame(), llcp_allocate_pdu() is called without holding the socket lock. If a concurrent disconnect frame transitions the socket to LLCP_CLOSED, a concurrent failed bind() can set llcp_sock->dev to NULL: net/nfc/llcp_commands.c:nfc_llcp_send_i_frame() { ... pdu = llcp_allocate_pdu(sock, LLCP_PDU_I, frag_len + LLCP_SEQUENCE_SIZE); ... } Which then calls nfc_alloc_send_skb() and dereferences the nullified sock->dev when computing the headroom: net/nfc/core.c:nfc_alloc_send_skb() { ... total_size = size + dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE; ... } Would it be necessary to apply a similar locking fix to nfc_llcp_send_i_frame() to prevent this NULL pointer dereference?