From patchwork Sun Dec 17 13:11:03 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddh Raman Pant X-Patchwork-Id: 180004 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:24d3:b0:fb:cd0c:d3e with SMTP id r19csp696685dyi; Sun, 17 Dec 2023 05:12:29 -0800 (PST) X-Google-Smtp-Source: AGHT+IEza6dyDccNpscjbKpwVYsEceIL1F9Pu5NnxpQuHbOkC3y7qWlDBxUS2rxIStFTwAx8ldgl X-Received: by 2002:a05:6a20:9387:b0:191:b898:91b9 with SMTP id x7-20020a056a20938700b00191b89891b9mr11177526pzh.0.1702818749499; Sun, 17 Dec 2023 05:12:29 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1702818749; cv=pass; d=google.com; s=arc-20160816; b=g3xzfs+n2F8/RTUTDKbQlQ1llqXVNAHG75W8gejxQLE0+0Yguqmufs+r9jGsCxKaE1 2PMW2RISCOQJpIOfwT7rNqbE5HBMZlOThTDgYf8Hc2Nw4QH1hDAnLgIBZpGvO7UzJL6P MFWBS7plmC4hYCEQSi5X8zGOnqBbwfJxQSyzxguyKU+hf98cRolacU7cxepGmt9KemFC eowfUr77Phe/rxpt7apRoRLyWvK5tQiepCbWJPvcYb6+j9LMsqVmOGtXtsf6Vg2KF1Zj 2dhW+dStia65E4obBLfW9FvC2lOI7dJ3O3xYTqDlhbk5OYT//9vToF7Z2+lvGluMQsI8 M+zQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=8WRK+iesJAbnH4jSLyDESYEBrykLMCNMgI+C244SKGQ=; fh=f/V/QDa2D8lb5A7foHMuPIYS+aJ2YNpcn7rUJucpAlY=; b=Yf9BEslEdPYy8I+4rnQ87K9571yXHqE1vuPyJ24UTMVNtvwl2kAkIubDdbHV7GJ6Xa BzWlwfYI/5e2G4tBjwstklUUYK0VujhPLpwPxhMyBX4wAL8gmFKUrkowFk/bno6n7F+J VKa5eVUyQ+8c20UO6fOxootFyO5Grlx9Qzd7G0ajCASp+1kacF0aTN3OgyEgCeys5Npn oGgMCb4bVXOccSRv+CCkOuKM9OSV+lqgZtlMvjMP/kf6tYj9wIDlk7On7KqlF4z/bG2I BGLvvVGZeAA38Ne5TRWaNW6wxlMNFyV53W8NrSWyyv8Is/MB5ygLX7iJa3ULx7nlcInG AGUA== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@siddh.me header.s=zmail header.b="XWxdG2t/"; arc=pass (i=1 spf=pass spfdomain=siddh.me dkim=pass dkdomain=siddh.me dmarc=pass fromdomain=siddh.me>); spf=pass (google.com: domain of linux-kernel+bounces-2591-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-2591-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=siddh.me Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id f15-20020a65628f000000b005bdbf2ac2d2si16052311pgv.85.2023.12.17.05.12.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 17 Dec 2023 05:12:29 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-2591-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@siddh.me header.s=zmail header.b="XWxdG2t/"; arc=pass (i=1 spf=pass spfdomain=siddh.me dkim=pass dkdomain=siddh.me dmarc=pass fromdomain=siddh.me>); spf=pass (google.com: domain of linux-kernel+bounces-2591-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-2591-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=siddh.me Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 30FAA282BB9 for ; Sun, 17 Dec 2023 13:12:29 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 62CA444C67; Sun, 17 Dec 2023 13:11:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=siddh.me header.i=code@siddh.me header.b="XWxdG2t/" X-Original-To: linux-kernel@vger.kernel.org Received: from sender-of-o51.zoho.in (sender-of-o51.zoho.in [103.117.158.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A05542AA5; Sun, 17 Dec 2023 13:11:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=siddh.me Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=siddh.me ARC-Seal: i=1; a=rsa-sha256; t=1702818675; cv=none; d=zohomail.in; s=zohoarc; b=HDDJxvglwfDtkgVMPa8hqysuAZOIyl+ZMMl7ynOB8dKyIcw+Fdw3DJcYcgr+DO8dUvpupFtiDRRgPYX7o1y0/noHfgKNKm40qeCRLrCGC2U5UfyZ73YIvv45NjJ47z3nMLnNMYl0wXgUktiIg/c6YPuRGp+cn4d1ZkZ+RKYpMvI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1702818675; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=8WRK+iesJAbnH4jSLyDESYEBrykLMCNMgI+C244SKGQ=; b=C8nIc+UAAwa28qMsMpokFyJEGyW0DrLfhrP+wTnYjKCrbgx5nvaUSNh8S+tNKVLRxaGByoVQ8Qf321OOIdx65v6ZVz96b1UiaDTbZG7Wm/D6fR30H0W3V99EHMzK7O2ojOlaeBb36SeIwcthex+UtQO30N4OY/q68JqqM43LR7g= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1702818675; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=8WRK+iesJAbnH4jSLyDESYEBrykLMCNMgI+C244SKGQ=; b=XWxdG2t/9Vy2/UgIDYE5STwOqDqz7qeRu9jhG4dEusicqHHkVClx1stkohAu5niz 6Zj51XMozqzDbkA538Y/sS/7jDoliRf1QnZ6YUG+0egQBBONa0VTntAyhQn0LahtIxL 9MLUDa4dECmhWzOFQptNWJArKav8IuXZQoNZQ9+0= Received: from kampyooter.. (122.170.167.40 [122.170.167.40]) by mx.zoho.in with SMTPS id 1702818673882496.18443141454156; Sun, 17 Dec 2023 18:41:13 +0530 (IST) From: Siddh Raman Pant To: Krzysztof Kozlowski , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Suman Ghosh Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+bbe84a4010eeea00982d@syzkaller.appspotmail.com Subject: [PATCH net-next v6 1/2] nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local Date: Sun, 17 Dec 2023 18:41:03 +0530 Message-ID: <0d812b9aae2f16691d373460b06c5f3e098ed2a6.1702816635.git.code@siddh.me> X-Mailer: git-send-email 2.42.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ZohoMailClient: External X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785534873177617037 X-GMAIL-MSGID: 1785534873177617037 llcp_sock_sendmsg() calls nfc_llcp_send_ui_frame() which in turn calls nfc_alloc_send_skb(), which accesses the nfc_dev from the llcp_sock for getting the headroom and tailroom needed for skb allocation. Parallelly the nfc_dev can be freed, as the refcount is decreased via nfc_free_device(), leading to a UAF reported by Syzkaller, which can be summarized as follows: (1) llcp_sock_sendmsg() -> nfc_llcp_send_ui_frame() -> nfc_alloc_send_skb() -> Dereference *nfc_dev (2) virtual_ncidev_close() -> nci_free_device() -> nfc_free_device() -> put_device() -> nfc_release() -> Free *nfc_dev When a reference to llcp_local is acquired, we do not acquire the same for the nfc_dev. This leads to freeing even when the llcp_local is in use, and this is the case with the UAF described above too. Thus, when we acquire a reference to llcp_local, we should acquire a reference to nfc_dev, and release the references appropriately later. References for llcp_local is initialized in nfc_llcp_register_device() (which is called by nfc_register_device()). Thus, we should acquire a reference to nfc_dev there. nfc_unregister_device() calls nfc_llcp_unregister_device() which in turn calls nfc_llcp_local_put(). Thus, the reference to nfc_dev is appropriately released later. Reported-and-tested-by: syzbot+bbe84a4010eeea00982d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=bbe84a4010eeea00982d Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket") Reviewed-by: Suman Ghosh Signed-off-by: Siddh Raman Pant --- net/nfc/llcp_core.c | 40 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 1dac28136e6a..fadc8a9ec4df 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -145,6 +145,13 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool device, static struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local) { + /* Since using nfc_llcp_local may result in usage of nfc_dev, whenever + * we hold a reference to local, we also need to hold a reference to + * the device to avoid UAF. + */ + if (!nfc_get_device(local->dev->idx)) + return NULL; + kref_get(&local->ref); return local; @@ -177,10 +184,18 @@ static void local_release(struct kref *ref) int nfc_llcp_local_put(struct nfc_llcp_local *local) { + struct nfc_dev *dev; + int ret; + if (local == NULL) return 0; - return kref_put(&local->ref, local_release); + dev = local->dev; + + ret = kref_put(&local->ref, local_release); + nfc_put_device(dev); + + return ret; } static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, @@ -959,8 +974,18 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local, } new_sock = nfc_llcp_sock(new_sk); - new_sock->dev = local->dev; + new_sock->local = nfc_llcp_local_get(local); + if (!new_sock->local) { + reason = LLCP_DM_REJ; + release_sock(&sock->sk); + sock_put(&sock->sk); + sock_put(&new_sock->sk); + nfc_llcp_sock_free(new_sock); + goto fail; + } + + new_sock->dev = local->dev; new_sock->rw = sock->rw; new_sock->miux = sock->miux; new_sock->nfc_protocol = sock->nfc_protocol; @@ -1597,7 +1622,16 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) if (local == NULL) return -ENOMEM; - local->dev = ndev; + /* As we are going to initialize local's refcount, we need to get the + * nfc_dev to avoid UAF, otherwise there is no point in continuing. + * See nfc_llcp_local_get(). + */ + local->dev = nfc_get_device(ndev->idx); + if (!local->dev) { + kfree(local); + return -ENODEV; + } + INIT_LIST_HEAD(&local->list); kref_init(&local->ref); mutex_init(&local->sdp_lock); From patchwork Sun Dec 17 13:11:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddh Raman Pant X-Patchwork-Id: 180005 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:24d3:b0:fb:cd0c:d3e with SMTP id r19csp696721dyi; Sun, 17 Dec 2023 05:12:34 -0800 (PST) X-Google-Smtp-Source: AGHT+IFgUsNGSQP5dYHeEX9z38HqEysJL66/rBUqJ7G+qC5hdb/J1/ftZqZQoXFCx0GcZb3IaD7V X-Received: by 2002:a05:620a:268f:b0:775:ed1e:2b14 with SMTP id c15-20020a05620a268f00b00775ed1e2b14mr19323524qkp.54.1702818754024; Sun, 17 Dec 2023 05:12:34 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1702818754; cv=pass; d=google.com; s=arc-20160816; b=Vo7DXxi3s/0iC9Xihm/LwzRgYZHXE8FFRmdXbOHSutvksyKLoVe9Y2kuXyUxUq1ReS v9/zbQ0xEUHrOL5msl5ZE0DVCWu+Or4SauTtBF7qPT2SXrhiJ5+kt3NBOUm7a/5OzU3x AeXDS3WjhYyX59DEFhkQtcwZ7S/hJMHbewfwoNv5AqIuxQo83YG5c7sEbR+O9aMYBd3T E52f3DrwdfEjyWF6sV5GnfQvpv4zV3P75w4Ks502qAhB8SlQ8Pvpsbi/ucqNzvAXflCE 1D3+5O1DJFEMbl0q5BuJyb+wwK2HBBREs21ngAyq8lTV1yHykPbDHrl6/XCOtK+e6g28 2NTA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=Scp3IrJnE67ltgIhAprfULm6HsQ/s5KxrhhmK7w7AQs=; fh=RACn3Dz57j2O2Diwusdo+qDZ4fbRHVAux3E9Xar2zXI=; b=tq405kh0gQjtiiGRepr4XkZcB21MvKQUu+uJbI7HfpxlzwYR6cDRUn5FfEqKFbC1UM hVGWg5LToVG54m1BLXmr1uqZaUTtpjRfGzCDZj/3CClucFEU5/z0iE1qxYwRiKwX3hO/ aiWPRD2gwEsWllSrSmifG9mCJzK+qOxEuE/Gf+swTCo/DiGGPFwAAnQPBWTKgfKf+Gey ZDQJkaTwgxdz/pz6dWlkFi9tw9G+gN7sq4i8Ui3x2xiLr7oZeC/HM08wD//hAGBURzlk WEzzpnqM5RebyjoyaGhLKywP6HOtN7RnnBUtYwPwM66mGkyDuqeOsLEHvGHjhm6Atuu+ uhDg== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@siddh.me header.s=zmail header.b=jaJKRVZz; arc=pass (i=1 spf=pass spfdomain=siddh.me dkim=pass dkdomain=siddh.me dmarc=pass fromdomain=siddh.me>); spf=pass (google.com: domain of linux-kernel+bounces-2592-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-2592-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=siddh.me Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [2604:1380:45d1:ec00::1]) by mx.google.com with ESMTPS id o22-20020a05620a2a1600b0077f6d73fac4si17632918qkp.475.2023.12.17.05.12.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 17 Dec 2023 05:12:34 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-2592-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@siddh.me header.s=zmail header.b=jaJKRVZz; arc=pass (i=1 spf=pass spfdomain=siddh.me dkim=pass dkdomain=siddh.me dmarc=pass fromdomain=siddh.me>); spf=pass (google.com: domain of linux-kernel+bounces-2592-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-2592-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=siddh.me Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id CE2FE1C20F11 for ; Sun, 17 Dec 2023 13:12:33 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D2B3B44C6E; Sun, 17 Dec 2023 13:11:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=siddh.me header.i=code@siddh.me header.b="jaJKRVZz" X-Original-To: linux-kernel@vger.kernel.org Received: from sender-of-o51.zoho.in (sender-of-o51.zoho.in [103.117.158.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 981814317A; Sun, 17 Dec 2023 13:11:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=siddh.me Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=siddh.me ARC-Seal: i=1; a=rsa-sha256; t=1702818675; cv=none; d=zohomail.in; s=zohoarc; b=AQdENfINNapZlrC/EctTnMZUARzUjwqbKHHbdEEIS+PA/YJq9Kr7O1NZFI/0CjCG9HNKGuBKx6jj7a9S5baUa/ElWre7+dGz5AiN1iCDebo4hOAojZCx+c4WI458hKsH2utYDcwJXDkSFJR5GguCBcu3srbWSBPiG/tqzspomMo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1702818675; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Scp3IrJnE67ltgIhAprfULm6HsQ/s5KxrhhmK7w7AQs=; b=RnMOfZmQGs6b+piHKyDlptYaeFtNUGn/VMBA0li+cpBYo4RoyAjFTb6QaFQ/QE19T2AAarLo69XjQ+A0AXp+8VOOEmZf25rvAYj4qOHEQBT/0N0cLZYhgcZ3YaxP/UGrKhg+q+PsXrZRIq747QSemHYzlChItQpMFHIXewCHScg= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1702818675; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=Scp3IrJnE67ltgIhAprfULm6HsQ/s5KxrhhmK7w7AQs=; b=jaJKRVZzCRbtac7qltv2l3keyMs1H8djk4xukyoEvvldO4gHlQB+2ZaM8m4ybNSg IY+MFe+jnwoU0p74HFXy6VvahDRpCQIkXcLOYKKG0j/6XKcWVGbbxOkEU71OM3AgVSI OU/VVQH77liZRBQ1Vgt47cjBXciQUwM/8e9nkmLo= Received: from kampyooter.. (122.170.167.40 [122.170.167.40]) by mx.zoho.in with SMTPS id 1702818674595848.1274981870353; Sun, 17 Dec 2023 18:41:14 +0530 (IST) From: Siddh Raman Pant To: Krzysztof Kozlowski , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Suman Ghosh Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net-next v6 2/2] nfc: Do not send datagram if socket state isn't LLCP_BOUND Date: Sun, 17 Dec 2023 18:41:04 +0530 Message-ID: X-Mailer: git-send-email 2.42.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ZohoMailClient: External X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785534877776825120 X-GMAIL-MSGID: 1785534877776825120 As we know we cannot send the datagram (state can be set to LLCP_CLOSED by nfc_llcp_socket_release()), there is no need to proceed further. Thus, bail out early from llcp_sock_sendmsg(). Signed-off-by: Siddh Raman Pant Reviewed-by: Krzysztof Kozlowski Reviewed-by: Suman Ghosh --- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c index 645677f84dba..819157bbb5a2 100644 --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct socket *sock, struct msghdr *msg, } if (sk->sk_type == SOCK_DGRAM) { + if (sk->sk_state != LLCP_BOUND) { + release_sock(sk); + return -ENOTCONN; + } + DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name);