From nobody Fri Jul 24 04:48:32 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7717943B3C8 for ; Thu, 23 Jul 2026 17:45:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828731; cv=none; b=qpCZvoui89uh/0ysZLhkFnsN0CwjP1OiKJUgAoKfPhb6+0C1uMBHN8vchK+a3Wn2ygR0D+Gj4UfDiTSPOF0LOztEQLXjrNu+c0Gt0lW8/ghSwps6ouYXlnxY+i6dwR0bHbD/6xLKyq+gZE7D324nqZroTgfCawpEFXhusMj8cpc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784828731; c=relaxed/simple; bh=GpzhhMRYN/iYCunxpNPlT1YqMOQKr247+Sq6sjGne+8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LA7dgK+3rkCYjRjjBdz6eJ7I/jI+090pM3dROq4wGtk34LJGxKRR59hp1ss5c3jdyFM/M/NEE3Fa3Hf/fGNra24/mU37LwbjtjFNx0qukrvTpT4QW3FTZF5awnGKas0DJC/BHx/XNxEUC2ikcm6+k0Rxe+cAewtRLoV89cRsWHk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Yfe7Wols; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Yfe7Wols" Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38e08baf860so1054924a91.2 for ; Thu, 23 Jul 2026 10:45:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784828723; x=1785433523; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=RgqjbyFDcZMHfHX0tAra4Pr08m1zwCx9sNwlnEiHric=; b=Yfe7WolsKTrTRTopElVAHT0zVMTaeGr0sk3bPh8RBYndlxFcxN6nANsNqrUlBmt2nx HYf+QNfwuzrnm45F0n25pHVGKGFQWAV6oCizSwRNW/7DKxqu/pxFwQDIKU7awLNiF3wR CBZ2sxPo7TlO522nHS95h/xcvnHVJMkApvEau+XQYsvCoLWA7cyZusatAU0Nssz7+m5X WTjlaf1+PIjp4ArCHzkobVCFoBL9BDIcv7uLncmikHJX8K+hmgch1T8AK1V23aFlLheY rvAJ9/nVlQ/UJRd+hmw4V0mYsT32bs3A7/Mc3mcn3PX/isGKLe2MMIYLRWgoeL6RDRg5 Gt1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784828723; x=1785433523; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RgqjbyFDcZMHfHX0tAra4Pr08m1zwCx9sNwlnEiHric=; b=FXyR+u8C1wjbU5xvNIBaDa8U/GGNaRKMQFGbPjJcQB13wJmiV3yo96VXKBP2NKX7iN APz5Oe9po3Vz4IBLO18Pc4NcMeZ6dy9i9awEUPul/OGJUts0RAB75xpnkznPGH7/6ork HLJo/8STxiYz3vs1evSsCYPuxRaStoDh3zum/QAlbSVh0nQW0zBSi9xc5h25Z0l9Yawk TP7Lnq9qyPjvVx3rL3kRpK+MemaY+egSs9J2z9N7aPSQ//ZfvQyJT/cki0HM41+Tu7zA X8vcPICXiYesHgqqjECdVlZgrnYfCE4EyfDrRIex9mGCfDT/EkkjD0DESGH61M/P58PF dLzQ== X-Forwarded-Encrypted: i=1; AHgh+Ro+R15nHCDcgf9nGQ2P6/Nl8FRLeA7Cp7YaeTxDMTDh3ceFwPvZ6noS2V5C045IRjgxbnAH8/+l/BcrU6Q=@vger.kernel.org X-Gm-Message-State: AOJu0Yz7blEgTmyAtPNFxk6oiEJjNmbJO//5GSqqcNHS9BuaAqCxGGt1 CF9CDqpNk07w2/0mpEZO5qqpG0iPrPVzvIDc6EjKMmZOS/8yFZxEKmnY X-Gm-Gg: AR+sD10w808dqfQ/MT2ucSXOB/NhL65Y/gnARTgV5pcUHpcqJ0PyrJzrzLXBQ8hlFpN QrbUDVJ1Vsb/jydRq/vCx+waR/hJsprKZJ0Mfaxq0trHRPaBtz0By+1oJ8ygZm11IZtSGmPt54P lApNekeYNPf7D6JbEbFvNkj8Gk/SIm6mak3idHtI8zRTU+e57LPNq6oxaVTv7mdbXU3hBNxvR2y Uu9t+fjBn56C7gyS3v6PDo4uyOCBQvfXtsEOMnA/EpHRXiHT2Yc6ZNno0NELIyjt/GyUrJ+VADZ Xq7l0XhdBJxzLbYuf/3xH7SbYDglMA04BlmgdDzLwGR39P/At8TusRLbLjr6OjPoKagc+FCsc77 kdB92o/eufmQ0GIY1kT3BwzfX7Iw1DUhrIoucLIL77a5SKPominVgPK1Wwex6p0hqBU3U7UQeAX zDoY0CKy2jGzGcD3EdSZHKgbPvvST3mziNE0uz3zLUwYPUYRw= X-Received: by 2002:a17:90b:52d0:b0:38e:9e9e:ec57 with SMTP id 98e67ed59e1d1-38ec667a731mr4035830a91.43.1784828723369; Thu, 23 Jul 2026 10:45:23 -0700 (PDT) Received: from fx.tailc0aff1.ts.net ([206.206.192.132]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13d13002f39sm18210216c88.1.2026.07.23.10.45.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 10:45:22 -0700 (PDT) From: Weiming Shi To: David Heidelberg , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: oe-linux-nfc@lists.linux.dev, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Xiang Mei , Weiming Shi Subject: [PATCH net v2] nfc: digital: fix use-after-free in nfc_digital_unregister_device() Date: Thu, 23 Jul 2026 10:44:51 -0700 Message-ID: <20260723174450.1015153-2-bestswngs@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nfc_digital_unregister_device() cancels cmd_work and cmd_complete_work once each and then frees the command queue. The two works re-arm each other: digital_wq_cmd_complete() ends with schedule_work(&ddev->cmd_work), and digital_wq_cmd() hands a command to the driver whose asynchronous completion schedules cmd_complete_work. cancel_work_sync() only waits for the instance it cancels; it does not stop the work from being queued again. A work re-armed after its cancel_work_sync() therefore runs concurrently with the cmd_queue cleanup and dereferences a digital_cmd the cleanup has already freed. digital_wq_cmd() widens the window by dropping cmd_lock before using the command it took from the queue, while the cleanup loop frees the commands without holding cmd_lock. It is reproducible with the software NFC simulator (CONFIG_NFC_SIM): start an NFC-DEP exchange between the two nfcsim devices and unload the module while it is running. BUG: KASAN: slab-use-after-free in digital_wq_cmd (net/nfc/digital_core.c:= 174) Read of size 1 by task kworker/1:5 Workqueue: events digital_wq_cmd digital_wq_cmd (net/nfc/digital_core.c:174) process_one_work worker_thread kthread Allocated by task 5124: digital_send_cmd (net/nfc/digital_core.c:234) digital_in_send_sdd_req digital_in_recv_sens_res digital_wq_cmd_complete (net/nfc/digital_core.c:134) Freed by task 4994: kfree nfc_digital_unregister_device (net/nfc/digital_core.c:859) nfcsim_device_free [nfcsim] nfcsim_exit [nfcsim] __do_sys_delete_module Use disable_work_sync() instead of cancel_work_sync() for the two command works. disable_work_sync() cancels the work and disables it, so any later schedule_work() -- whether from the sibling work re-arming it or from the driver's completion callback -- becomes a no-op. Once both works are disabled no work can run, and the cleanup loop frees the queue with no work able to reach a freed command. Fixes: 59ee2361c924 ("NFC Digital: Implement driver commands mechanism") Reported-by: Xiang Mei Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi --- v2: retarget net-next -> net (Daniel Zahka); no code change. disable_work_sync() is v6.10+, so this is not Cc: stable; a backportable shutting_down-flag variant can follow for -stable if wanted. net/nfc/digital_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c index 7cb1e6aaae90..6def5132a4a6 100644 --- a/net/nfc/digital_core.c +++ b/net/nfc/digital_core.c @@ -843,8 +843,8 @@ void nfc_digital_unregister_device(struct nfc_digital_d= ev *ddev) mutex_unlock(&ddev->poll_lock); =20 cancel_delayed_work_sync(&ddev->poll_work); - cancel_work_sync(&ddev->cmd_work); - cancel_work_sync(&ddev->cmd_complete_work); + disable_work_sync(&ddev->cmd_work); + disable_work_sync(&ddev->cmd_complete_work); =20 list_for_each_entry_safe(cmd, n, &ddev->cmd_queue, queue) { list_del(&cmd->queue); base-commit: b2ff91b752b0d85e8815e7f44fd85205c4268094 --=20 2.43.0