From nobody Fri Dec 19 11:22:01 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF458C10F07 for ; Sat, 9 Dec 2023 11:05:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230025AbjLILFI (ORCPT ); Sat, 9 Dec 2023 06:05:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229791AbjLILFD (ORCPT ); Sat, 9 Dec 2023 06:05:03 -0500 Received: from sender-of-o51.zoho.in (sender-of-o51.zoho.in [103.117.158.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4101B10E6; Sat, 9 Dec 2023 03:05:07 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702119866; cv=none; d=zohomail.in; s=zohoarc; b=B811NESP0jokoVx2W9ggjXGr4+BAmEt/+ZAinFeKNk+sQ7DlmcM6XwE79IHvBuzAmeML12PQo2FhYdAw2KDka25OTM2ysnDMLJBGkh3Bvc0zyt1EaGFHymoo3kG0JDhXcqDtGipLe74DORkEE/scCIi9UsJ0MV8zKJrv581viW0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1702119866; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=yavI52OC8tlbl19v66raaOoqMeQlZYQq2S/tCxbIsG4=; b=bZcxKFbVK3OJok5Uuad2GtmU1C9y4HwnfT5y3sGOrZRXsM2H+NeKNQ5sfNNKiQDL/cG8mFp4NbWRok+OAbJitA8jRcJq58+s0zOMgI8ip0hHi2Zs7yVgx/ME/TmgBRl9jVPEW/1N7WElRbR39CkK2ELC21/I35FPNbX2/ubX7bo= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1702119866; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=yavI52OC8tlbl19v66raaOoqMeQlZYQq2S/tCxbIsG4=; b=t8i0miUC4Omfh4RcDBWWuBDTN8zZrbw7hQUz8r2bO9oGd+VgCNkuaoFBeIp4Xnl9 0WRIPGb4rBiy5lvMmm2x0DV8RwZd/AjX3FwxwNVQ3CRnhIL+Rbdaju6DGl7w8Vge1cM 0lWtrrEoWl/HKHtAzRPPZOs+Tkij+TZYFjxEF3BM= Received: from kampyooter.. (110.227.243.208 [110.227.243.208]) by mx.zoho.in with SMTPS id 1702119865209276.2854511924712; Sat, 9 Dec 2023 16:34:25 +0530 (IST) From: Siddh Raman Pant To: Krzysztof Kozlowski , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Suman Ghosh Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+bbe84a4010eeea00982d@syzkaller.appspotmail.com Subject: [PATCH net-next v4 1/2] nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local Date: Sat, 9 Dec 2023 16:34:20 +0530 Message-ID: <4233248c0ca219693c6e6476aa6e59c799241ac8.1702118242.git.code@siddh.me> X-Mailer: git-send-email 2.42.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" llcp_sock_sendmsg() calls nfc_llcp_send_ui_frame() which in turn calls nfc_alloc_send_skb(), which accesses the nfc_dev from the llcp_sock for getting the headroom and tailroom needed for skb allocation. Parallelly the nfc_dev can be freed, as the refcount is decreased via nfc_free_device(), leading to a UAF reported by Syzkaller, which can be summarized as follows: (1) llcp_sock_sendmsg() -> nfc_llcp_send_ui_frame() -> nfc_alloc_send_skb() -> Dereference *nfc_dev (2) virtual_ncidev_close() -> nci_free_device() -> nfc_free_device() -> put_device() -> nfc_release() -> Free *nfc_dev When a reference to llcp_local is acquired, we do not acquire the same for the nfc_dev. This leads to freeing even when the llcp_local is in use, and this is the case with the UAF described above too. Thus, when we acquire a reference to llcp_local, we should acquire a reference to nfc_dev, and release the references appropriately later. References for llcp_local is initialized in nfc_llcp_register_device() (which is called by nfc_register_device()). Thus, we should acquire a reference to nfc_dev there. nfc_unregister_device() calls nfc_llcp_unregister_device() which in turn calls nfc_llcp_local_put(). Thus, the reference to nfc_dev is appropriately released later. Reported-and-tested-by: syzbot+bbe84a4010eeea00982d@syzkaller.appspotmail.c= om Closes: https://syzkaller.appspot.com/bug?extid=3Dbbe84a4010eeea00982d Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when = creating a socket") Signed-off-by: Siddh Raman Pant Reviewed-by: Suman Ghosh --- net/nfc/llcp_core.c | 55 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 13 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 1dac28136e6a..0ae89ab42aaa 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -145,6 +145,13 @@ static void nfc_llcp_socket_release(struct nfc_llcp_lo= cal *local, bool device, =20 static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *lo= cal) { + /* Since using nfc_llcp_local may result in usage of nfc_dev, whenever + * we hold a reference to local, we also need to hold a reference to + * the device to avoid UAF. + */ + if (!nfc_get_device(local->dev->idx)) + return NULL; + kref_get(&local->ref); =20 return local; @@ -177,10 +184,18 @@ static void local_release(struct kref *ref) =20 int nfc_llcp_local_put(struct nfc_llcp_local *local) { + struct nfc_dev *dev; + int ret; + if (local =3D=3D NULL) return 0; =20 - return kref_put(&local->ref, local_release); + dev =3D local->dev; + + ret =3D kref_put(&local->ref, local_release); + nfc_put_device(dev); + + return ret; } =20 static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *loca= l, @@ -930,9 +945,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local= *local, =20 if (sk_acceptq_is_full(parent)) { reason =3D LLCP_DM_REJ; - release_sock(&sock->sk); - sock_put(&sock->sk); - goto fail; + goto fail_put_sock; } =20 if (sock->ssap =3D=3D LLCP_SDP_UNBOUND) { @@ -942,9 +955,7 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local= *local, =20 if (ssap =3D=3D LLCP_SAP_MAX) { reason =3D LLCP_DM_REJ; - release_sock(&sock->sk); - sock_put(&sock->sk); - goto fail; + goto fail_put_sock; } =20 sock->ssap =3D ssap; @@ -953,14 +964,18 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_loc= al *local, new_sk =3D nfc_llcp_sock_alloc(NULL, parent->sk_type, GFP_ATOMIC, 0); if (new_sk =3D=3D NULL) { reason =3D LLCP_DM_REJ; - release_sock(&sock->sk); - sock_put(&sock->sk); - goto fail; + goto fail_put_sock; } =20 new_sock =3D nfc_llcp_sock(new_sk); - new_sock->dev =3D local->dev; + new_sock->local =3D nfc_llcp_local_get(local); + if (!new_sock->local) { + reason =3D LLCP_DM_REJ; + goto fail_free_new_sock; + } + + new_sock->dev =3D local->dev; new_sock->rw =3D sock->rw; new_sock->miux =3D sock->miux; new_sock->nfc_protocol =3D sock->nfc_protocol; @@ -1004,8 +1019,13 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_lo= cal *local, =20 return; =20 +fail_free_new_sock: + sock_put(&new_sock->sk); + nfc_llcp_sock_free(new_sock); +fail_put_sock: + release_sock(&sock->sk); + sock_put(&sock->sk); fail: - /* Send DM */ nfc_llcp_send_dm(local, dsap, ssap, reason); } =20 @@ -1597,7 +1617,16 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) if (local =3D=3D NULL) return -ENOMEM; =20 - local->dev =3D ndev; + /* As we are going to initialize local's refcount, we need to get the + * nfc_dev to avoid UAF, otherwise there is no point in continuing. + * See nfc_llcp_local_get(). + */ + local->dev =3D nfc_get_device(ndev->idx); + if (!local->dev) { + kfree(local); + return -ENODEV; + } + INIT_LIST_HEAD(&local->list); kref_init(&local->ref); mutex_init(&local->sdp_lock); --=20 2.42.0 From nobody Fri Dec 19 11:22:01 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB9B1C4167B for ; Sat, 9 Dec 2023 11:05:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229921AbjLILFE (ORCPT ); Sat, 9 Dec 2023 06:05:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229446AbjLILFC (ORCPT ); Sat, 9 Dec 2023 06:05:02 -0500 Received: from sender-of-o51.zoho.in (sender-of-o51.zoho.in [103.117.158.51]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EBB1310C8; Sat, 9 Dec 2023 03:05:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702119867; cv=none; d=zohomail.in; s=zohoarc; b=J05YNytQQ08OVuEdffm0ONXgnJz70v6PpR74ibqfIFaAG39gVFS/F97r+BcBED5cTm/SqE7UOUJb8ufbVLVymHG1haE6V69eEV9Fhu0KSObbOfK5RlJHF+xHQ4PccxoWt9vwb/C9iGs8Ks501gwQ+fNoyikp+ENGb4YRAMRyjME= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1702119867; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Scp3IrJnE67ltgIhAprfULm6HsQ/s5KxrhhmK7w7AQs=; b=ZDAUYayn2MUkW3y3O+V8hqpZbFHaay/Av5s+Gxd8bhI626qK4Ixg73Z/4FvrCzYxjv6FQmvbCBFyZREoF8CThp468IN5u+me/YaOdrQCmn7k17dWkpZspoV6at+Eh28ZAQz9LCsmc40K12X3Wzm80+K66QiU+r7l0/UuNj67sqQ= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1702119867; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=Scp3IrJnE67ltgIhAprfULm6HsQ/s5KxrhhmK7w7AQs=; b=iMDwsRhC0/xem8Bu+VmUiIJDrKS1Ja2e/WXxWEMgbD3barv4hDhni9K2KkfF6YTb edfvTrwBZtrR8tcC0BMujRKxjRwPPpn+LH+xCNcTj6t+ESAPyy+8J/QoJg88o33awNA BDHWs7LuOHQLwZue22pKG7+9Src4aeeu+DFyaeJo= Received: from kampyooter.. (110.227.243.208 [110.227.243.208]) by mx.zoho.in with SMTPS id 1702119865580645.3578578519617; Sat, 9 Dec 2023 16:34:25 +0530 (IST) From: Siddh Raman Pant To: Krzysztof Kozlowski , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Suman Ghosh Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net-next v4 2/2] nfc: Do not send datagram if socket state isn't LLCP_BOUND Date: Sat, 9 Dec 2023 16:34:21 +0530 Message-ID: X-Mailer: git-send-email 2.42.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" As we know we cannot send the datagram (state can be set to LLCP_CLOSED by nfc_llcp_socket_release()), there is no need to proceed further. Thus, bail out early from llcp_sock_sendmsg(). Signed-off-by: Siddh Raman Pant Reviewed-by: Krzysztof Kozlowski Reviewed-by: Suman Ghosh --- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index 645677f84dba..819157bbb5a2 100644 --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct socket *sock, stru= ct msghdr *msg, } =20 if (sk->sk_type =3D=3D SOCK_DGRAM) { + if (sk->sk_state !=3D LLCP_BOUND) { + release_sock(sk); + return -ENOTCONN; + } + DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name); =20 --=20 2.42.0