[PATCH] nfc: llcp: Fix socket reference leak in nfc_llcp_recv_ui()

[PATCH] nfc: llcp: Fix socket reference leak in nfc_llcp_recv_ui()

[Wentao Liang]

In nfc_llcp_recv_ui(), nfc_llcp_sock_get() is called to find the bound
socket. If the socket type is not SOCK_DGRAM, the function returns
directly without releasing the socket reference via nfc_llcp_sock_put(),
resulting in a reference count leak.

Add nfc_llcp_sock_put() when the socket type is not SOCK_DGRAM.

Fixes: 968272bf0087 ("NFC: Handle LLCP UI frames")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/nfc/llcp_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index db5bc6a878dd..5813c80ca593 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -888,8 +888,12 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
 
 	/* We're looking for a bound socket, not a client one */
 	llcp_sock = nfc_llcp_sock_get(local, dsap, LLCP_SAP_SDP);
-	if (llcp_sock == NULL || llcp_sock->sk.sk_type != SOCK_DGRAM)
+	if (!llcp_sock)
 		return;
+	if (llcp_sock->sk.sk_type != SOCK_DGRAM) {
+		nfc_llcp_sock_put(llcp_sock);
+		return;
+	}
 
 	/* There is no sequence with UI frames */
 	skb_pull(skb, LLCP_HEADER_SIZE);
-- 
2.34.1

Re: [PATCH] nfc: llcp: Fix socket reference leak in nfc_llcp_recv_ui()

[Xuanqiang Luo]

在 2026/9/16 15:34, Wentao Liang 写道:
> In nfc_llcp_recv_ui(), nfc_llcp_sock_get() is called to find the bound
> socket. If the socket type is not SOCK_DGRAM, the function returns
> directly without releasing the socket reference via nfc_llcp_sock_put(),
> resulting in a reference count leak.
> 
> Add nfc_llcp_sock_put() when the socket type is not SOCK_DGRAM.
> 
> Fixes: 968272bf0087 ("NFC: Handle LLCP UI frames")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   net/nfc/llcp_core.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index db5bc6a878dd..5813c80ca593 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -888,8 +888,12 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
>   
>   	/* We're looking for a bound socket, not a client one */
>   	llcp_sock = nfc_llcp_sock_get(local, dsap, LLCP_SAP_SDP);
> -	if (llcp_sock == NULL || llcp_sock->sk.sk_type != SOCK_DGRAM)
> +	if (!llcp_sock)
>   		return;
> +	if (llcp_sock->sk.sk_type != SOCK_DGRAM) {
> +		nfc_llcp_sock_put(llcp_sock);
> +		return;
> +	}
>   
>   	/* There is no sequence with UI frames */
>   	skb_pull(skb, LLCP_HEADER_SIZE);

Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Please use the [PATCH net] subject prefix for fixes targeting the net 
tree. See the netdev submission guidelines:

https://docs.kernel.org/process/maintainer-netdev.html#networking-subsystem-netdev

Thanks,
Xuanqiang