lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 228/247] nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
    Date
    From: Martin Faltesek <mfaltesek@google.com>

    commit 996419e0594abb311fb958553809f24f38e7abbe upstream.

    Error paths do not free previously allocated memory. Add devm_kfree() to
    those failure paths.

    Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support")
    Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION")
    Cc: stable@vger.kernel.org
    Signed-off-by: Martin Faltesek <mfaltesek@google.com>
    Reviewed-by: Guenter Roeck <groeck@chromium.org>
    Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/nfc/st21nfca/se.c | 13 ++++++++++---
    1 file changed, 10 insertions(+), 3 deletions(-)

    --- a/drivers/nfc/st21nfca/se.c
    +++ b/drivers/nfc/st21nfca/se.c
    @@ -330,22 +330,29 @@ int st21nfca_connectivity_event_received
    transaction->aid_len = skb->data[1];

    /* Checking if the length of the AID is valid */
    - if (transaction->aid_len > sizeof(transaction->aid))
    + if (transaction->aid_len > sizeof(transaction->aid)) {
    + devm_kfree(dev, transaction);
    return -EINVAL;
    + }

    memcpy(transaction->aid, &skb->data[2],
    transaction->aid_len);

    /* Check next byte is PARAMETERS tag (82) */
    if (skb->data[transaction->aid_len + 2] !=
    - NFC_EVT_TRANSACTION_PARAMS_TAG)
    + NFC_EVT_TRANSACTION_PARAMS_TAG) {
    + devm_kfree(dev, transaction);
    return -EPROTO;
    + }

    transaction->params_len = skb->data[transaction->aid_len + 3];

    /* Total size is allocated (skb->len - 2) minus fixed array members */
    - if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
    + if (transaction->params_len > ((skb->len - 2) -
    + sizeof(struct nfc_evt_transaction))) {
    + devm_kfree(dev, transaction);
    return -EINVAL;
    + }

    memcpy(transaction->params, skb->data +
    transaction->aid_len + 4, transaction->params_len);

    \
     
     \ /
      Last update: 2022-06-13 15:25    [W:4.023 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site