Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Votokina Victoria 276820278e nfc: hci: shdlc: Stop timers and work before freeing context ... [ Upstream commit c9efde1e53 ] llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races. Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4a61cd6687 ("NFC: Add an shdlc llc module to llc core") Signed-off-by: Votokina Victoria <Victoria.Votokina@kaspersky.com> Link: https://patch.msgid.link/20260203113158.2008723-1-Victoria.Votokina@kaspersky.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2026-02-26 14:59:20 -08:00
..
command.c	nfc: drop unneeded debug prints	2021-10-11 17:00:51 -07:00
core.c	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
hci.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
hcp.c	NFC: hci: Split memcpy() of struct hcp_message flexible array	2022-09-27 07:45:18 -07:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
llc.c	nfc: hci: Remove unused nfc_llc_unregister	2025-02-19 19:04:26 -08:00
llc.h	nfc: hci: Remove unused nfc_llc_unregister	2025-02-19 19:04:26 -08:00
llc_nop.c	nfc: constify nfc_llc_ops	2021-07-25 09:21:21 +01:00
llc_shdlc.c	nfc: hci: shdlc: Stop timers and work before freeing context	2026-02-26 14:59:20 -08:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00