lkml.org 
[lkml]   [2015]   [Sep]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.2 004/134] NFC: st21nfca: fix use of uninitialized variables in error path
    Date
    4.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Christophe Ricard <christophe.ricard@gmail.com>

    commit 5a3570061a131309143a49e4bbdbce7e23f261e7 upstream.

    st21nfca_hci_load_session() calls kfree_skb() on unitialized
    variables skb_pipe_info and skb_pipe_list if the call to
    nfc_hci_connect_gate() failed. Reword the error path to not use
    these variables when they are not initialized. While at it, there
    seemed to be a memory leak because skb_pipe_info was only freed
    once, after the for-loop, even though several ones were created
    by nfc_hci_send_cmd.

    Fixes: ec03ff1a8f9a
    ("NFC: st21nfca: Remove skb_pipe_list and skb_pipe_info
    useless allocation")

    Acked-by: Christophe Ricard <christophe-h.ricard@st.com>
    Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/nfc/st21nfca/st21nfca.c | 11 ++++++-----
    1 file changed, 6 insertions(+), 5 deletions(-)

    --- a/drivers/nfc/st21nfca/st21nfca.c
    +++ b/drivers/nfc/st21nfca/st21nfca.c
    @@ -148,14 +148,14 @@ static int st21nfca_hci_load_session(str
    ST21NFCA_DEVICE_MGNT_GATE,
    ST21NFCA_DEVICE_MGNT_PIPE);
    if (r < 0)
    - goto free_info;
    + return r;

    /* Get pipe list */
    r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
    ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list),
    &skb_pipe_list);
    if (r < 0)
    - goto free_info;
    + return r;

    /* Complete the existing gate_pipe table */
    for (i = 0; i < skb_pipe_list->len; i++) {
    @@ -181,6 +181,7 @@ static int st21nfca_hci_load_session(str
    info->src_host_id != ST21NFCA_ESE_HOST_ID) {
    pr_err("Unexpected apdu_reader pipe on host %x\n",
    info->src_host_id);
    + kfree_skb(skb_pipe_info);
    continue;
    }

    @@ -200,6 +201,7 @@ static int st21nfca_hci_load_session(str
    hdev->pipes[st21nfca_gates[j].pipe].dest_host =
    info->src_host_id;
    }
    + kfree_skb(skb_pipe_info);
    }

    /*
    @@ -214,13 +216,12 @@ static int st21nfca_hci_load_session(str
    st21nfca_gates[i].gate,
    st21nfca_gates[i].pipe);
    if (r < 0)
    - goto free_info;
    + goto free_list;
    }
    }

    memcpy(hdev->init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
    -free_info:
    - kfree_skb(skb_pipe_info);
    +free_list:
    kfree_skb(skb_pipe_list);
    return r;
    }



    \
     
     \ /
      Last update: 2015-09-27 00:41    [W:4.034 / U:0.572 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site