Re: [PATCH] nfc: llcp: Fix socket reference leak in nfc_llcp_recv_ui()

[Xuanqiang Luo]

在 2026/9/16 15:34, Wentao Liang 写道:
> In nfc_llcp_recv_ui(), nfc_llcp_sock_get() is called to find the bound
> socket. If the socket type is not SOCK_DGRAM, the function returns
> directly without releasing the socket reference via nfc_llcp_sock_put(),
> resulting in a reference count leak.
>
> Add nfc_llcp_sock_put() when the socket type is not SOCK_DGRAM.
>
> Fixes: 968272bf0087 ("NFC: Handle LLCP UI frames")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
>   net/nfc/llcp_core.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index db5bc6a878dd..5813c80ca593 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -888,8 +888,12 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
>   
>   	/* We're looking for a bound socket, not a client one */
>   	llcp_sock = nfc_llcp_sock_get(local, dsap, LLCP_SAP_SDP);
> -	if (llcp_sock == NULL || llcp_sock->sk.sk_type != SOCK_DGRAM)
> +	if (!llcp_sock)
>   		return;
> +	if (llcp_sock->sk.sk_type != SOCK_DGRAM) {
> +		nfc_llcp_sock_put(llcp_sock);
> +		return;
> +	}
>   
>   	/* There is no sequence with UI frames */
>   	skb_pull(skb, LLCP_HEADER_SIZE);

Reviewed-by: Xuanqiang Luo <luoxuanqiang@xxxxxxxxxx>

Please use the [PATCH net] subject prefix for fixes targeting the net 
tree. See the netdev submission guidelines:

https://docs.kernel.org/process/maintainer-netdev.html#networking-subsystem-netdev

Thanks,
Xuanqiang