Votokina Victoria cf70cedce3 nfc: hci: shdlc: Stop timers and work before freeing context ...

[ Upstream commit c9efde1e53 ]

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc
structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state
and the skb queues. If teardown happens in parallel with a queued/running
work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the
queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4a61cd6687 ("NFC: Add an shdlc llc module to llc core")
Signed-off-by: Votokina Victoria <Victoria.Votokina@kaspersky.com>
Link: https://patch.msgid.link/20260203113158.2008723-1-Victoria.Votokina@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-03-04 07:20:09 -05:00

..

command.c

…

core.c

…

hci.h

…

hcp.c

…

Kconfig

…

llc_nop.c

…

llc_shdlc.c

nfc: hci: shdlc: Stop timers and work before freeing context

2026-03-04 07:20:09 -05:00

llc.c

nfc: hci: Save a few bytes of memory when registering a 'nfc_llc' engine

2024-02-06 15:36:06 +01:00

llc.h

…

Makefile

…