diff options
| author | Eric Dumazet <[email protected]> | 2023-10-09 12:31:10 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2023-10-10 19:44:44 -0700 |
| commit | 31c07dffafce914c1d1543c135382a11ff058d93 (patch) | |
| tree | a15c17e01991ccee548344146a861e1cbcc80a93 /net/lapb/lapb_timer.c | |
| parent | 5093bbfc10ab6636b32728e35813cbd79feb063c (diff) | |
net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.
Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.
nfc_llcp_sock_get_sn() has a similar problem.
Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.
Fixes: 8f50020ed9b8 ("NFC: LLCP late binding")
Reported-by: Sili Luo <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Willy Tarreau <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions