Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fce324b authored by Martin Faltesek's avatar Martin Faltesek Committed by Greg Kroah-Hartman
Browse files

nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling 



commit 996419e0594abb311fb958553809f24f38e7abbe upstream.

Error paths do not free previously allocated memory. Add devm_kfree() to
those failure paths.

Fixes: 26fc6c7f ("NFC: st21nfca: Add HCI transaction event support")
Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMartin Faltesek <mfaltesek@google.com>
Reviewed-by: default avatarGuenter Roeck <groeck@chromium.org>
Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2146a57e

drivers/nfc/st21nfca/se.c

+10 −3
Original line number Diff line number Diff line
@@ -342,22 +342,29 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 
		transaction->aid_len = skb->data[1];



		/* Checking if the length of the AID is valid */

		if (transaction->aid_len > sizeof(transaction->aid))

		if (transaction->aid_len > sizeof(transaction->aid)) {

			devm_kfree(dev, transaction);

			return -EINVAL;

		}



		memcpy(transaction->aid, &skb->data[2],

		       transaction->aid_len);



		/* Check next byte is PARAMETERS tag (82) */

		if (skb->data[transaction->aid_len + 2] !=

		    NFC_EVT_TRANSACTION_PARAMS_TAG)

		    NFC_EVT_TRANSACTION_PARAMS_TAG) {

			devm_kfree(dev, transaction);

			return -EPROTO;

		}



		transaction->params_len = skb->data[transaction->aid_len + 3];



		/* Total size is allocated (skb->len - 2) minus fixed array members */

		if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))

		if (transaction->params_len > ((skb->len - 2) -

		    sizeof(struct nfc_evt_transaction))) {

			devm_kfree(dev, transaction);

			return -EINVAL;

		}



		memcpy(transaction->params, skb->data +

		       transaction->aid_len + 4, transaction->params_len);