net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()

stable inclusion
from stable-v5.10.199
commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP
CVE: CVE-2023-52502

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9



---------------------------

[ Upstream commit 31c07dff ]

Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.

Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.

nfc_llcp_sock_get_sn() has a similar problem.

Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.

Fixes: 8f50020e ("NFC: LLCP late binding")
Reported-by: Sili Luo <rootlab@huawei.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Liu Jian <liujian56@huawei.com>