Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit daaf1e1f authored by Christophe Ricard's avatar Christophe Ricard Committed by Samuel Ortiz
Browse files

NFC: st-nci: fix use of uninitialized variables in error path 



st_nci_hci_load_session() calls kfree_skb() on unitialized
variables skb_pipe_info and skb_pipe_list if the call to
nci_hci_connect_gate() failed. Reword the error path to not use
these variables when they are not initialized. While at it, there
seemed to be a memory leak because skb_pipe_info was only freed
once, after the for-loop, even though several ones were created
by nci_hci_send_cmd.

Cc: stable@vger.kernel.org
Acked-by: default avatarChristophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: default avatarNicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
parent 5a357006

drivers/nfc/st-nci/st-nci_se.c

+4 −4
Original line number Diff line number Diff line
@@ -189,14 +189,14 @@ int st_nci_hci_load_session(struct nci_dev *ndev) 
				ST_NCI_DEVICE_MGNT_GATE,

				ST_NCI_DEVICE_MGNT_PIPE);

	if (r < 0)

		goto free_info;

		return r;



	/* Get pipe list */

	r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,

			ST_NCI_DM_GETINFO, pipe_list, sizeof(pipe_list),

			&skb_pipe_list);

	if (r < 0)

		goto free_info;

		return r;



	/* Complete the existing gate_pipe table */

	for (i = 0; i < skb_pipe_list->len; i++) {
@@ -222,6 +222,7 @@ int st_nci_hci_load_session(struct nci_dev *ndev) 
		    dm_pipe_info->src_host_id != ST_NCI_ESE_HOST_ID) {

			pr_err("Unexpected apdu_reader pipe on host %x\n",

			       dm_pipe_info->src_host_id);

			kfree_skb(skb_pipe_info);

			continue;

		}
@@ -241,13 +242,12 @@ int st_nci_hci_load_session(struct nci_dev *ndev) 
			ndev->hci_dev->pipes[st_nci_gates[j].pipe].host =

						dm_pipe_info->src_host_id;

		}

		kfree_skb(skb_pipe_info);

	}



	memcpy(ndev->hci_dev->init_data.gates, st_nci_gates,

	       sizeof(st_nci_gates));



free_info:

	kfree_skb(skb_pipe_info);

	kfree_skb(skb_pipe_list);

	return r;

}