nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

A race condition exists in the NFC LLCP connection state machine where
the connection acceptance packet (CC) can be processed concurrently with
socket release.  This can lead to a use-after-free of the socket object.

When nfc_llcp_recv_cc() moves the socket from the connecting_sockets
list to the sockets list, it does so without holding the socket lock.
If llcp_sock_release() is executing concurrently, it might have already
unlinked the socket and dropped its references, which can result in
nfc_llcp_recv_cc() linking a freed socket into the live list.

Fix this by holding lock_sock() during the state transition and list
movement in nfc_llcp_recv_cc().  After acquiring the lock, check if
the socket is still hashed to ensure it hasn't already been unlinked
and marked for destruction by the release path.  This aligns the locking
pattern with recv_hdlc() and recv_disc().

Fixes: a69f32af86e3 ("NFC: Socket linked list")
Signed-off-by: Lee Jones <lee@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260429134115.3558604-2-lee@kernel.org
Signed-off-by: David Heidelberg <david@ixit.cz>

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index db5bc6a878ddb064a71418a3745cb906dcf7a624..dc65c719f35f2e6334d5edd2f1b83347de1d34c1 100644 (file)
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -1218,6 +1218,15 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
 
        sk = &llcp_sock->sk;
 
+       lock_sock(sk);
+
+       /* Check if socket was destroyed whilst waiting for the lock */
+       if (!sk_hashed(sk)) {
+               release_sock(sk);
+               nfc_llcp_sock_put(llcp_sock);
+               return;
+       }
+
        /* Unlink from connecting and link to the client array */
        nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
        nfc_llcp_sock_link(&local->sockets, sk);
@@ -1229,6 +1238,8 @@ static void nfc_llcp_recv_cc(struct nfc_llcp_local *local,
        sk->sk_state = LLCP_CONNECTED;
        sk->sk_state_change(sk);
 
+       release_sock(sk);
+
        nfc_llcp_sock_put(llcp_sock);
 }