* [PATCH] NFC: st21nfca: fix double free
@ 2019-11-07 1:33 Pan Bian
2019-11-07 5:50 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Pan Bian @ 2019-11-07 1:33 UTC (permalink / raw)
To: Thomas Gleixner, Allison Randal, Kate Stewart, Greg Kroah-Hartman
Cc: netdev, linux-kernel, Pan Bian
The variable nfcid_skb is not changed in the callee nfc_hci_get_param()
if error occurs. Consequently, the freed variable nfcid_skb will be
freed again, resulting in a double free bug. Set nfcid_skb to NULL after
releasing it to fix the bug.
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/nfc/st21nfca/core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/nfc/st21nfca/core.c b/drivers/nfc/st21nfca/core.c
index f9ac176cf257..2ce17932a073 100644
--- a/drivers/nfc/st21nfca/core.c
+++ b/drivers/nfc/st21nfca/core.c
@@ -708,6 +708,7 @@ static int st21nfca_hci_complete_target_discovered(struct nfc_hci_dev *hdev,
NFC_PROTO_FELICA_MASK;
} else {
kfree_skb(nfcid_skb);
+ nfcid_skb = NULL;
/* P2P in type A */
r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_F_GATE,
ST21NFCA_RF_READER_F_NFCID1,
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] NFC: st21nfca: fix double free
2019-11-07 1:33 [PATCH] NFC: st21nfca: fix double free Pan Bian
@ 2019-11-07 5:50 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-11-07 5:50 UTC (permalink / raw)
To: bianpan2016; +Cc: tglx, allison, kstewart, gregkh, netdev, linux-kernel
From: Pan Bian <bianpan2016@163.com>
Date: Thu, 7 Nov 2019 09:33:20 +0800
> The variable nfcid_skb is not changed in the callee nfc_hci_get_param()
> if error occurs. Consequently, the freed variable nfcid_skb will be
> freed again, resulting in a double free bug. Set nfcid_skb to NULL after
> releasing it to fix the bug.
>
> Signed-off-by: Pan Bian <bianpan2016@163.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-11-07 5:51 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-07 1:33 [PATCH] NFC: st21nfca: fix double free Pan Bian
2019-11-07 5:50 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.