A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

UPSTREAM: nfc: llcp: add missing return after LLCP_CLOSED checks

Browse source 
In nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket
state is LLCP_CLOSED, the code correctly calls release_sock() and
nfc_llcp_sock_put() but fails to return. Execution falls through to
the remainder of the function, which calls release_sock() and
nfc_llcp_sock_put() again. This results in a double release_sock()
and a refcount underflow via double nfc_llcp_sock_put(), leading to
a use-after-free.

Add the missing return statements after the LLCP_CLOSED branches
in both functions to prevent the fall-through.

Bug: 499350302
Fixes: d646960f79 ("NFC: Initial LLCP support")
Signed-off-by: Junxi Qian <qjx1298677004@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260408081006.3723-1-qjx1298677004@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 2b5dd4632966c39da6ba74dbc8689b309065e82c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I041f20fc1fea32f715d2646579fab071e58688d8
This commit is contained in:
Junxi Qian 2026-04-08 16:10:06 +08:00 • committed by Michael Bestas
commit d3d47118ab
No known key found for this signature in database
GPG key ID: CC95044519BE6669
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
net/nfc/llcp_core.c
View file

@ -1096,6 +1096,7 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
if (sk->sk_state == LLCP_CLOSED) {
release_sock(sk);
nfc_llcp_sock_put(llcp_sock);
return;
}
/* Pass the payload upstream */
@ -1187,6 +1188,7 @@ static void nfc_llcp_recv_disc(struct nfc_llcp_local *local,
if (sk->sk_state == LLCP_CLOSED) {
release_sock(sk);
nfc_llcp_sock_put(llcp_sock);
return;
}
if (sk->sk_state == LLCP_CONNECTED) {