Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7adcf014 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() 



[ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ]

Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.

Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.

nfc_llcp_sock_get_sn() has a similar problem.

Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.

Fixes: 8f50020e ("NFC: LLCP late binding")
Reported-by: default avatarSili Luo <rootlab@huawei.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 22ca282e

net/nfc/llcp_core.c

+12 −18
Original line number Diff line number Diff line
@@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, 


		if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) {

			llcp_sock = tmp_sock;

			sock_hold(&llcp_sock->sk);

			break;

		}

	}



	read_unlock(&local->sockets.lock);



	if (llcp_sock == NULL)

		return NULL;



	sock_hold(&llcp_sock->sk);



	return llcp_sock;

}
@@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len) 


static

struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,

					    const u8 *sn, size_t sn_len)

					    const u8 *sn, size_t sn_len,

					    bool needref)

{

	struct sock *sk;

	struct nfc_llcp_sock *llcp_sock, *tmp_sock;
@@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, 


		if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) {

			llcp_sock = tmp_sock;

			if (needref)

				sock_hold(&llcp_sock->sk);

			break;

		}

	}
@@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, 
		 * to this service name.

		 */

		if (nfc_llcp_sock_from_sn(local, sock->service_name,

					  sock->service_name_len) != NULL) {

					  sock->service_name_len,

					  false) != NULL) {

			mutex_unlock(&local->sdp_lock);



			return LLCP_SAP_MAX;
@@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local 
static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,

						  const u8 *sn, size_t sn_len)

{

	struct nfc_llcp_sock *llcp_sock;



	llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len);



	if (llcp_sock == NULL)

		return NULL;



	sock_hold(&llcp_sock->sk);



	return llcp_sock;

	return nfc_llcp_sock_from_sn(local, sn, sn_len, true);

}



static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len)
@@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, 
			}



			llcp_sock = nfc_llcp_sock_from_sn(local, service_name,

							  service_name_len);

							  service_name_len,

							  true);

			if (!llcp_sock) {

				sap = 0;

				goto add_snl;
@@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, 


				if (sap == LLCP_SAP_MAX) {

					sap = 0;

					nfc_llcp_sock_put(llcp_sock);

					goto add_snl;

				}
@@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, 


			pr_debug("%p %d\n", llcp_sock, sap);



			nfc_llcp_sock_put(llcp_sock);

add_snl:

			sdp = nfc_llcp_build_sdres_tlv(tid, sap);

			if (sdp == NULL)