github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
v7.0
linux/net/nfc
History
Jakub Kicinski 4527025d44 nfc: nci: fix circular locking dependency in nci_close_device 
nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
This causes a circular locking dependency because nci_rx_work()
running on rx_wq can end up taking req_lock too:

  nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
    -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
    -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)

Move the flush of rx_wq after req_lock has been released.
This should safe (I think) because NCI_UP has already been cleared
and the transport is closed, so the work will see it and return
-ENETDOWN.

NIPA has been hitting this running the nci selftest with a debug
kernel on roughly 4% of the runs.

Fixes: 6a2968aaf5 ("NFC: basic NCI protocol implementation")
Reviewed-by: Ian Ray <ian.ray@gehealthcare.com>
Link: https://patch.msgid.link/20260317193334.988609-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-19 16:56:18 -07:00
..
hci Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
nci nfc: nci: fix circular locking dependency in nci_close_device 2026-03-19 16:56:18 -07:00
af_nfc.c nfc: fix error handling of nfc_proto_register() 2021-10-13 17:32:38 -07:00
core.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
digital_core.c nfc: digital: free skb on digital_in_send error paths 2026-03-04 18:16:10 -08:00
digital_dep.c net:nfc:digital: Fix a double free in digital_tg_recv_dep_req 2021-04-27 15:36:10 -07:00
digital_technology.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
digital.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
Kconfig net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
llcp_commands.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
llcp_core.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
llcp_sock.c net: Convert proto_ops connect() callbacks to use sockaddr_unsized 2025-11-04 19:10:32 -08:00
llcp.h net: nfc: Fix use-after-free caused by nfc_llcp_find_local 2023-06-26 10:57:23 +01:00
Makefile
netlink.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
nfc.h net: nfc: Fix use-after-free caused by nfc_llcp_find_local 2023-06-26 10:57:23 +01:00
rawsock.c nfc: rawsock: cancel tx_work before socket teardown 2026-03-04 18:18:57 -08:00