Description
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference. NIPA occasionally hits this leak: unreferenced object 0xff1100000f435000 (size 2048): comm "nci_dev", pid 3954, jiffies 4295441245 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 27 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 '..@............ backtrace (crc ec2b3c5): __kmalloc_noprof+0x4db/0x730 sk_prot_alloc.isra.0+0xe4/0x1d0 sk_alloc+0x36/0x760 rawsock_create+0xd1/0x540 nfc_sock_create+0x11f/0x280 __sock_create+0x22d/0x630 __sys_socket+0x115/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0x117/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Product status
38f04c6b1b682f1879441e2925403ad9aff9e229 (git) before 9df613ef6e8e873cdab969a11f74823488977f1f
38f04c6b1b682f1879441e2925403ad9aff9e229 (git) before 702029337b057085ea13f964822dcd95e0fe53f5
38f04c6b1b682f1879441e2925403ad9aff9e229 (git) before 91ff0d8c3464da7f0c43da38c195e60b660128bf
38f04c6b1b682f1879441e2925403ad9aff9e229 (git) before d05f55d68ebdebb2b0a8480d766eaae88c8c92de
38f04c6b1b682f1879441e2925403ad9aff9e229 (git) before 66083581945bd5b8e99fe49b5aeb83d03f62d053
3.2
Any version before 3.2
6.6.136 (semver)
6.12.82 (semver)
6.18.17 (semver)
6.19.7 (semver)
7.0 (original_commit_for_fix)
References
git.kernel.org/...c/9df613ef6e8e873cdab969a11f74823488977f1f
git.kernel.org/...c/702029337b057085ea13f964822dcd95e0fe53f5
git.kernel.org/...c/91ff0d8c3464da7f0c43da38c195e60b660128bf
git.kernel.org/...c/d05f55d68ebdebb2b0a8480d766eaae88c8c92de
git.kernel.org/...c/66083581945bd5b8e99fe49b5aeb83d03f62d053