netdev - Re: [PATCH v1 net] nfc: llcp: Fix memleak in nfc_llcp_send_ui

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXejUMWyl51mlr5Q@horms.kernel.org>
Date: Mon, 26 Jan 2026 17:24:32 +0000
From: Simon Horman <horms@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...gle.com>
Cc: "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Samuel Ortiz <sameo@...ux.intel.com>,
	Kuniyuki Iwashima <kuni1840@...il.com>, netdev@...r.kernel.org,
	syzbot+f2d245f1d76bbfa50e4c@...kaller.appspotmail.com
Subject: Re: [PATCH v1 net] nfc: llcp: Fix memleak in
 nfc_llcp_send_ui_frame().

On Sun, Jan 25, 2026 at 12:59:28AM +0000, Kuniyuki Iwashima wrote:
> syzbot reported various memory leaks related to NFC, struct
> nfc_llcp_sock, sk_buff, nfc_dev, etc. [0]
> 
> The leading log hinted that nfc_llcp_send_ui_frame() failed
> to allocate skb due to sock_error(sk) being -ENXIO.
> 
> ENXIO is set by nfc_llcp_socket_release() when struct
> nfc_llcp_local is destroyed by local_cleanup().
> 
> The problem is that there is no synchronisation between
> nfc_llcp_send_ui_frame() and local_cleanup(), and skb
> could be put into local->tx_queue after it was purged in
> local_cleanup():
> 
>   CPU1                          CPU2
>   ----                          ----
>   nfc_llcp_send_ui_frame()      local_cleanup()
>   |- do {                       '
>      |- pdu = nfc_alloc_send_skb(..., &err)
>      |                          .
>      |                          |- nfc_llcp_socket_release(local, false, ENXIO);
>      |                          |- skb_queue_purge(&local->tx_queue);      |
>      |                          '                                          |
>      |- skb_queue_tail(&local->tx_queue, pdu);                             |
>     ...                                                                    |
>      |- pdu = nfc_alloc_send_skb(..., &err)                                |
>                                        ^._________________________________.'
> 
> local_cleanup() is called for struct nfc_llcp_local only
> after nfc_llcp_remove_local() unlinks it from llcp_devices.
> 
> If we hold local->tx_queue.lock then, we can synchronise
> the thread and nfc_llcp_send_ui_frame().
> 
> Let's do that and check list_empty(&local->list) before
> queuing skb to local->tx_queue in nfc_llcp_send_ui_frame().

...

> Fixes: 94f418a20664 ("NFC: UI frame sending routine implementation")
> Reported-by: syzbot+f2d245f1d76bbfa50e4c@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/697569c7.a00a0220.33ccc7.0014.GAE@google.com/T/#u
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>

Reviewed-by: Simon Horman <horms@...nel.org>