Re: [PATCH 1/1] nfc: llcp: fix use-after-free in llcp_sock_release()

[Lee Jones]

On Wed, 29 Apr 2026, Eric Dumazet wrote:

> On Wed, Apr 29, 2026 at 6:22 AM Lee Jones <lee@xxxxxxxxxx> wrote:
> >
> > llcp_sock_release() unconditionally unlinks the socket from the local
> > sockets list.  However, if the socket is still in connecting state, it
> > is on the connecting list.
> >
> > Fix this by checking the socket state and unlinking from the correct list.
> >
> > Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
> > ---
> >  net/nfc/llcp_sock.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
> > index f1be1e84f6653..feab29fc62f44 100644
> > --- a/net/nfc/llcp_sock.c
> > +++ b/net/nfc/llcp_sock.c
> > @@ -633,6 +633,8 @@ static int llcp_sock_release(struct socket *sock)
> >
> >         if (sock->type == SOCK_RAW)
> >                 nfc_llcp_sock_unlink(&local->raw_sockets, sk);
> > +       else if (sk->sk_state == LLCP_CONNECTING)
> > +               nfc_llcp_sock_unlink(&local->connecting_sockets, sk);
> >         else
> >                 nfc_llcp_sock_unlink(&local->sockets, sk);
> >
> > --
> > 2.54.0.545.g6539524ca2-goog
> >
> 
> Why are you sending this patch a second time?

Because I am a dunce and forgot to clear out my send cache before
sending a related but different patch.

> You forgot to add a Fixes: tag, as requested for all networking patches.

No problem.  Please ignore both of these and I'll follow-up with a
coherent set with `Fixes:` tags applied.

-- 
Lee Jones