From: Suyuan Wang <redacted>
st21nfca_im_send_atr_req() allocates an skb for the ATR_REQ, passes
its data to the HCI layer and then forgets about it:
return nfc_hci_send_cmd_async(hdev, ST21NFCA_RF_READER_F_GATE,
ST21NFCA_WR_XCHG_DATA, skb->data,
skb->len, info->async_cb, info);
nfc_hci_send_cmd_async() copies the payload into its own fragments, so
the skb is still ours to free. As it is, one skb leaks on every ATR_REQ
sent in initiator mode, whether or not the command was queued.
Free it right after the call, on success and on error, as
st21nfca_tx_work() does for the same call.
Found with a static analysis tool and checked by hand.
Fixes: 1892bf844ea0 ("NFC: st21nfca: Adding P2P support to st21nfca in Initiator & Target mode")
Cc: <redacted>
Co-developed-by: Kaixuan Li <redacted>
Signed-off-by: Kaixuan Li <redacted>
Signed-off-by: Suyuan Wang <redacted>
---
Compile tested only, I don't have ST21NFCA hardware.
---
drivers/nfc/st21nfca/dep.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c
index a5fab4fd5129..4b9054eb0208 100644
--- a/drivers/nfc/st21nfca/dep.c
+++ b/drivers/nfc/st21nfca/dep.c
@@ -496,6 +496,7 @@ int st21nfca_im_send_atr_req(struct nfc_hci_dev *hdev, u8 *gb, size_t gb_len)
struct st21nfca_atr_req *atr_req;
struct nfc_target *target;
uint size;
+ int r;
info->dep_info.to = ST21NFCA_DEFAULT_TIMEOUT;
size = ST21NFCA_ATR_REQ_MIN_SIZE + gb_len;
@@ -547,9 +548,11 @@ int st21nfca_im_send_atr_req(struct nfc_hci_dev *hdev, u8 *gb, size_t gb_len)
info->dep_info.bsi = atr_req->bsi;
info->dep_info.lri = ST21NFCA_PP2LRI(atr_req->ppi);
- return nfc_hci_send_cmd_async(hdev, ST21NFCA_RF_READER_F_GATE,
- ST21NFCA_WR_XCHG_DATA, skb->data,
- skb->len, info->async_cb, info);
+ r = nfc_hci_send_cmd_async(hdev, ST21NFCA_RF_READER_F_GATE,
+ ST21NFCA_WR_XCHG_DATA, skb->data,
+ skb->len, info->async_cb, info);
+ kfree_skb(skb);
+ return r;
}
EXPORT_SYMBOL(st21nfca_im_send_atr_req);
--
2.34.1