[PATCH] nfc: llcp: Fix nfc_dev refcount leak in connect

[Shuangpeng Bai]

llcp_sock_connect() takes a reference to the NFC device with
nfc_get_device() and stores it in llcp_sock->dev before moving the
socket to LLCP_CONNECTING.

If such a pending connection is released before reaching
LLCP_CONNECTED, llcp_sock_destruct() does not drop that device
reference because it only handles connected sockets. This leaks the
nfc_dev reference acquired during connect.

Drop the device reference for LLCP_CONNECTING sockets as well.

Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>
---
 net/nfc/llcp_sock.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index feab29fc62f4..44639ccd438e 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -960,7 +960,8 @@ static void llcp_sock_destruct(struct sock *sk)
 
 	pr_debug("%p\n", sk);
 
-	if (sk->sk_state == LLCP_CONNECTED)
+	if (sk->sk_state == LLCP_CONNECTED ||
+	    sk->sk_state == LLCP_CONNECTING)
 		nfc_put_device(llcp_sock->dev);
 
 	skb_queue_purge(&sk->sk_receive_queue);
-- 
2.43.0