Re: [PATCH] nfc: llcp: Fix local use-after-free in nfc_llcp_general_bytes()

[Simon Horman]

+ Ren Wei

On Thu, Sep 17, 2026 at 04:38:36PM +0000, Wentao Liang wrote:
> nfc_llcp_general_bytes() drops the reference on the llcp local structure
> with nfc_llcp_local_put() and then still reads local->gb for the return
> value. If that was the last reference, the local structure is freed and
> the read happens on freed memory.
> 
> Capture the pointer to the general bytes before dropping the reference
> so the local structure is no longer used after the put.
> 
> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

I believe this duplicates a more comprehensive approach by Ren Wei:
- [PATCH 1/1] nfc: llcp: Pass caller buffer to nfc_llcp_general_bytes to fix UAF and memory leaks
  https://lore.kernel.org/all/006437e618b55acc0df69d94255244a490b11461.1786029423.git.rakukuip@xxxxxxxxx/

Please check prior work before posting patches.

> ---
>  net/nfc/llcp_core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
> index db5bc6a878dd..d0f17fbacfee 100644
> --- a/net/nfc/llcp_core.c
> +++ b/net/nfc/llcp_core.c
> @@ -638,6 +638,7 @@ static int nfc_llcp_build_gb(struct nfc_llcp_local *local)
>  u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
>  {
>  	struct nfc_llcp_local *local;
> +	u8 *gb;
>  
>  	local = nfc_llcp_find_local(dev);
>  	if (local == NULL) {
> @@ -648,10 +649,11 @@ u8 *nfc_llcp_general_bytes(struct nfc_dev *dev, size_t *general_bytes_len)
>  	nfc_llcp_build_gb(local);
>  
>  	*general_bytes_len = local->gb_len;
> +	gb = local->gb;
>  
>  	nfc_llcp_local_put(local);
>  
> -	return local->gb;
> +	return gb;
>  }
>  
>  int nfc_llcp_set_remote_gb(struct nfc_dev *dev, const u8 *gb, u8 gb_len)
> -- 
> 2.34.1
>