| Message ID | ff2e1639a591e413ce95eb64dea85751292c0be0.1700943019.git.code@siddh.me (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Fix UAF caused by racing datagram sending and freeing of nfc_dev | expand |
On 25/11/2023 21:26, Siddh Raman Pant wrote: > As we know we cannot send the datagram (state can be set to LLCP_CLOSED > by nfc_llcp_socket_release()), there is no need to proceed further. > > Thus, bail out early from llcp_sock_sendmsg(). > > Signed-off-by: Siddh Raman Pant <code@siddh.me> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index ef1ab88a5e4f..603f2219b62f 100644 --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg, } if (sk->sk_type == SOCK_DGRAM) { + if (sk->sk_state != LLCP_BOUND) { + release_sock(sk); + return -ENOTCONN; + } + DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name);
As we know we cannot send the datagram (state can be set to LLCP_CLOSED by nfc_llcp_socket_release()), there is no need to proceed further. Thus, bail out early from llcp_sock_sendmsg(). Signed-off-by: Siddh Raman Pant <code@siddh.me> --- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+)