diff options
| author | Eric Dumazet | 2023-10-09 12:31:10 +0000 |
|---|---|---|
| committer | Jakub Kicinski | 2023-10-10 19:44:44 -0700 |
| commit | 31c07dffafce914c1d1543c135382a11ff058d93 (patch) | |
| tree | a15c17e01991ccee548344146a861e1cbcc80a93 /kernel/cred.c | |
| parent | 5093bbfc10ab6636b32728e35813cbd79feb063c (diff) | |
net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.
Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.
nfc_llcp_sock_get_sn() has a similar problem.
Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.
Fixes: 8f50020ed9b8 ("NFC: LLCP late binding")
Reported-by: Sili Luo <rootlab@huawei.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'kernel/cred.c')
0 files changed, 0 insertions, 0 deletions