Re: [BUG] nfc: llcp: race between nfc_llcp_send_ui_frame() and llcp_sock_bind() dereferences NULL sock->dev

On 14/07/2026 02:00, Junwoong Doh wrote:

Hello,

Commit dded08927ca3 ("nfc: llcp: fix NULL error pointer dereference on
sendmsg() after failed bind()") added a NULL check for llcp_sock->local
in llcp_sock_sendmsg(), but it does not handle all the races.
The thread interleaving is the same as Krzysztof mentioned:
https://lore.kernel.org/oe-linux-nfc/20220119074816.6505-2-krzysztof.kozlowski@canonical.com/ (local)

In detail:
nfc_llcp_send_ui_frame() checks sock->local == NULL, but it is called
without socket's lock held, which opens a window for a race condition.
Between the sock->local == NULL check and the sock->dev use in
nfc_alloc_send_skb(), llcp_sock_bind() can run concurrently and set
both sock->local and sock->dev to NULL.
This leads to NULL pointer dereference in the nfc_alloc_send_skb() call.
Moreover, the window can be enlarged by the
memcpy_from_msg(msg_data, msg, len) call that sits between
the sock->local check and the sock->dev use.

Hello Junwoong,

thank you for the report. Would you be willing to try preparing a patch against 
the NFC for-next or for-linus tree to fix the issue?

Thank you
David

[...]