* [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
@ 2021-11-05 13:36 Chengfeng Ye
2021-11-05 14:33 ` Dan Carpenter
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Chengfeng Ye @ 2021-11-05 13:36 UTC (permalink / raw)
To: krzysztof.kozlowski, davem, kuba, wengjianfeng, dan.carpenter
Cc: netdev, linux-kernel, Chengfeng Ye
skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
but follow error handler branch when pn533_fill_fragment_skbs()
fails, skb is freed again, results in double free issue. Fix this
by not free skb in error path of pn533_fill_fragment_skbs.
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
drivers/nfc/pn533/pn533.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index 787bcbd290f7..a491db46e3bd 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2216,7 +2216,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
frag = pn533_alloc_skb(dev, frag_size);
if (!frag) {
skb_queue_purge(&dev->fragment_skb);
- break;
+ return -ENOMEM;
}
if (!dev->tgt_mode) {
@@ -2285,7 +2285,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
/* jumbo frame ? */
if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
rc = pn533_fill_fragment_skbs(dev, skb);
- if (rc <= 0)
+ if (rc < 0)
goto error;
skb = skb_dequeue(&dev->fragment_skb);
@@ -2353,7 +2353,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
/* let's split in multiple chunks if size's too big */
if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
rc = pn533_fill_fragment_skbs(dev, skb);
- if (rc <= 0)
+ if (rc < 0)
goto error;
/* get the first skb */
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
2021-11-05 13:36 [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Chengfeng Ye
@ 2021-11-05 14:33 ` Dan Carpenter
2021-11-06 9:42 ` Krzysztof Kozlowski
2021-11-07 19:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2021-11-05 14:33 UTC (permalink / raw)
To: Chengfeng Ye
Cc: krzysztof.kozlowski, davem, kuba, wengjianfeng, netdev, linux-kernel
On Fri, Nov 05, 2021 at 06:36:36AM -0700, Chengfeng Ye wrote:
> skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
> but follow error handler branch when pn533_fill_fragment_skbs()
> fails, skb is freed again, results in double free issue. Fix this
> by not free skb in error path of pn533_fill_fragment_skbs.
>
> Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
I sort of wish the commit message talked more about the how this changes
the failure return from 0 to -ENOMEM. But the patch is good.
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
2021-11-05 13:36 [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Chengfeng Ye
2021-11-05 14:33 ` Dan Carpenter
@ 2021-11-06 9:42 ` Krzysztof Kozlowski
2021-11-07 19:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Krzysztof Kozlowski @ 2021-11-06 9:42 UTC (permalink / raw)
To: Chengfeng Ye, davem, kuba, wengjianfeng, dan.carpenter
Cc: netdev, linux-kernel
On 05/11/2021 14:36, Chengfeng Ye wrote:
> skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
> but follow error handler branch when pn533_fill_fragment_skbs()
> fails, skb is freed again, results in double free issue. Fix this
> by not free skb in error path of pn533_fill_fragment_skbs.
>
> Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
> ---
> drivers/nfc/pn533/pn533.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
Looks good, thanks:
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Please do not forget about fixes tag. Here it is trickier because
pn533_fill_fragment_skbs() usage was introduced in two commits:
Fixes: 963a82e07d4e ("NFC: pn533: Split large Tx frames in chunks")
Fixes: 93ad42020c2d ("NFC: pn533: Target mode Tx fragmentation support")
Cc: <stable@vger.kernel.org>
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
2021-11-05 13:36 [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Chengfeng Ye
2021-11-05 14:33 ` Dan Carpenter
2021-11-06 9:42 ` Krzysztof Kozlowski
@ 2021-11-07 19:40 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-11-07 19:40 UTC (permalink / raw)
To: Chengfeng Ye
Cc: krzysztof.kozlowski, davem, kuba, wengjianfeng, dan.carpenter,
netdev, linux-kernel
Hello:
This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:
On Fri, 5 Nov 2021 06:36:36 -0700 you wrote:
> skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
> but follow error handler branch when pn533_fill_fragment_skbs()
> fails, skb is freed again, results in double free issue. Fix this
> by not free skb in error path of pn533_fill_fragment_skbs.
>
> Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
>
> [...]
Here is the summary with links:
- [v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
https://git.kernel.org/netdev/net/c/9fec40f85065
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-11-07 19:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-05 13:36 [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails Chengfeng Ye
2021-11-05 14:33 ` Dan Carpenter
2021-11-06 9:42 ` Krzysztof Kozlowski
2021-11-07 19:40 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.