net: nfc: fix use-after-free in nfc_get_local_general_bytes

From: Luxiao Xu <[email protected]>

This series addresses a use-after-free (UAF) regression introduced by commit 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local").

In commit 6709d4b7bc2e, nfc_llcp_local_put(local) was added right before returning local->gb. However, if the reference count drops to zero, the object is immediately freed, causing callers accessing the returned pointer to trigger a use-after-free.

Using dynamic allocation (e.g. kmemdup) to copy the buffer was evaluated in v1, but it led to memory leaks because all callers consistently treat the returned buffer as borrowed memory and do not free it.

To solve this properly without lifetime issues or leaks, this patch refactors nfc_llcp_general_bytes() and nfc_get_local_general_bytes() to take a caller-provided destination buffer and maximum length. The bytes are safely copied before dropping the reference via nfc_llcp_local_put(). All callers in core and drivers (microread, pn533, pn544, st21nfca, digital_dep, and nci) are updated accordingly.

---
v3:
- Include <net/nfc/nfc.h> in pn533.h to fix build error in uart.c caused by undefined NFC_MAX_GT_LEN.
- Restore nci_request() in nci_set_local_general_bytes() to preserve ndev->req_lock synchronization (avoid unlocked __nci_request() via nci_set_config()).
v2 Link: https://lore.kernel.org/all/[email protected]/
v2:
- Use caller-provided output buffers to fix UAF instead of dynamic allocation (kmemdup), avoiding memory leaks.

Luxiao Xu (1):
net: nfc: fix use-after-free in nfc_get_local_general_bytes

 drivers/nfc/microread/microread.c |  6 +++---
 drivers/nfc/pn533/pn533.c         | 14 ++++++++------
 drivers/nfc/pn533/pn533.h         |  4 +++-
 drivers/nfc/pn544/pn544.c         |  7 +++----
 drivers/nfc/st21nfca/core.c       |  8 ++++----
 include/net/nfc/hci.h             |  2 +-
 include/net/nfc/nfc.h             |  3 ++-
 net/nfc/core.c                    | 15 +++++++--------
 net/nfc/digital_dep.c             |  8 ++++----
 net/nfc/llcp_core.c               | 17 +++++++++++++----
 net/nfc/nci/core.c                | 10 +++++-----
 net/nfc/nfc.h                     |  3 ++-
 12 files changed, 55 insertions(+), 42 deletions(-)

2.43.0