Messages in this thread | | | From | Amit Pundir <> | Date | Mon, 23 Apr 2018 22:50:19 +0530 | Subject | Re: [RESEND][PATCH 2/4] NFC: st21nfca: Fix memory OOB and leak issues in connectivity events handler |
| |
On 20 April 2018 at 18:09, Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote: > On Wed, 2018-04-18 at 15:35 +0530, Amit Pundir wrote: > >> if (skb->data[transaction->aid_len + 2] != >> - NFC_EVT_TRANSACTION_PARAMS_TAG) >> + NFC_EVT_TRANSACTION_PARAMS_TAG || >> + skb->len < transaction->aid_len + transaction- >> >params_len + 4) { > >> + devm_kfree(dev, transaction); > > Oh, no. > > This is not memory leak per se, this is bad choice of devm_ API where it > should use plain kmalloc() / kfree(). >
Hi, If I switch to kmalloc()/kfree() with allocation and may be pre-usage checks along the way up to nfc_genl_se_transaction() would that suffice? I believe, I still be needing the additional aid_len and params_len checks regardless, right?
Regards, Amit Pundir
>> return -EPROTO; >> + } > > -- > Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Intel Finland Oy
| |