[PATCH] nfc: llcp: Fix local use-after-free in nfc_llcp_general_bytes()

[Wentao Liang]

nfc_llcp_general_bytes() drops the reference on the llcp local structure
with nfc_llcp_local_put() and then still reads local->gb for the return
value. If that was the last reference, the local structure is freed and
the read happens on freed memory.

Capture the pointer to the general bytes before dropping the reference
so the local structure is no longer used after the put.

Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 net/nfc/llcp_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index db5bc6a878dd..d0f17fbacfee 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -638,6 +638,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
 u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 {
 	struct nfc_llcp_local *local;
+	u8 *gb;
 
 	local = nfc_llcp_find_local(dev);
 	if (local == NULL) {
@@ -648,10 +649,11 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
 	nfc_llcp_build_gb(local);
 
 	*general_bytes_len = local->gb_len;
+	gb = local->gb;
 
 	nfc_llcp_local_put(local);
 
-	return local->gb;
+	return gb;
 }
 
 int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
-- 
2.34.1