]> git.ipfire.org Git - thirdparty/linux.git/commit
nfc: llcp: Fix use-after-free in llcp_sock_release()
authorLee Jones <lee@kernel.org>
Wed, 29 Apr 2026 13:40:41 +0000 (13:40 +0000)
committerDavid Heidelberg <david@ixit.cz>
Tue, 5 May 2026 09:37:10 +0000 (11:37 +0200)
commitf4268b466190dae95a7585f69b4f1f8ad097632c
tree96e7da17bf5c1f1934305391484480f04f5243dc
parent7fd2df204f342fc17d1a0bfcd474b24232fb0f32
nfc: llcp: Fix use-after-free in llcp_sock_release()

llcp_sock_release() unconditionally unlinks the socket from the local
sockets list.  However, if the socket is still in connecting state, it
is on the connecting list.

Fix this by checking the socket state and unlinking from the correct list.

Fixes: b4011239a08e ("NFC: llcp: Fix non blocking sockets connections")
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://patch.msgid.link/20260429134115.3558604-1-lee@kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>
net/nfc/llcp_sock.c