averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-07-14 21:43:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

nfc: hci: shdlc: Stop timers and work before freeing context

Browse Source 
[ Upstream commit c9efde1e53 ]

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc
structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state
and the skb queues. If teardown happens in parallel with a queued/running
work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the
queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4a61cd6687 ("NFC: Add an shdlc llc module to llc core")
Signed-off-by: Votokina Victoria <Victoria.Votokina@kaspersky.com>
Link: https://patch.msgid.link/20260203113158.2008723-1-Victoria.Votokina@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Votokina Victoria
2026-03-04 07:19:43 -05:00
committed by Sasha Levin
parent a01c3073f8
commit a24a676329
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/nfc/hci/llc_shdlc.c
+8
View File
@@ -762,6 +762,14 @@ static void llc_shdlc_deinit(struct nfc_llc *llc)
{
struct llc_shdlc *shdlc = nfc_llc_get_data(llc);
timer_shutdown_sync(&shdlc->connect_timer);
timer_shutdown_sync(&shdlc->t1_timer);
timer_shutdown_sync(&shdlc->t2_timer);
shdlc->t1_active = false;
shdlc->t2_active = false;
cancel_work_sync(&shdlc->sm_work);
skb_queue_purge(&shdlc->rcv_q);
skb_queue_purge(&shdlc->send_q);
skb_queue_purge(&shdlc->ack_pending_q);