[PATCH] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
From: Chengfeng Ye <hidden>
Date: 2021-11-05 13:19:30
Also in:
lkml
Subsystem:
nfc subsystem, the rest · Maintainers:
David Heidelberg, Linus Torvalds
skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs, but follow error handler branch when pn533_fill_fragment_skbs() fails, skb is freed again, results in double free issue. Fix this by not free skb when pn533_fill_fragment_skbs() return value <= 0. Signed-off-by: Chengfeng Ye <redacted> --- drivers/nfc/pn533/pn533.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index 787bcbd290f7..226ae4357f7f 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c@@ -2285,8 +2285,10 @@ static int pn533_transceive(struct nfc_dev *nfc_dev, /* jumbo frame ? */ if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { rc = pn533_fill_fragment_skbs(dev, skb); - if (rc <= 0) - goto error; + if (rc <= 0) { + kfree(arg); + return rc; + } skb = skb_dequeue(&dev->fragment_skb); if (!skb) {
@@ -2353,8 +2355,11 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb) /* let's split in multiple chunks if size's too big */ if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) { rc = pn533_fill_fragment_skbs(dev, skb); - if (rc <= 0) - goto error; + if (rc <= 0) { + if (rc < 0) + skb_queue_purge(&dev->fragment_skb); + return rc; + } /* get the first skb */ skb = skb_dequeue(&dev->fragment_skb);
--
2.17.1