[PATCH 0/3] nfc: Fix potential memory leak of skb

[PATCH 0/3] nfc: Fix potential memory leak of skb

[Shang XiaoJing]

There are still somewhere maybe leak the skb, fix the memleaks by adding
fail path.

Shang XiaoJing (3):
  nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
  nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
  nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()

 drivers/nfc/nfcmrvl/i2c.c  | 4 +++-
 drivers/nfc/nxp-nci/core.c | 8 ++++++--
 drivers/nfc/s3fwrn5/core.c | 1 +
 3 files changed, 10 insertions(+), 3 deletions(-)

-- 
2.17.1

[PATCH 1/3] nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()

[Shang XiaoJing]

nfcmrvl_i2c_nci_send() will be called by nfcmrvl_nci_send(), and skb
should be freed in nfcmrvl_i2c_nci_send(). However, nfcmrvl_nci_send()
won't free the skb when it failed for the test_bit(). Free the skb when
test_bit() failed.

Fixes: b5b3e23e4cac ("NFC: nfcmrvl: add i2c driver")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Suggested-by: Pavel Machek <pavel@denx.de>
---
 drivers/nfc/nfcmrvl/i2c.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nfc/nfcmrvl/i2c.c b/drivers/nfc/nfcmrvl/i2c.c
index 24436c9e54c9..97600826af69 100644
--- a/drivers/nfc/nfcmrvl/i2c.c
+++ b/drivers/nfc/nfcmrvl/i2c.c
@@ -112,8 +112,10 @@ static int nfcmrvl_i2c_nci_send(struct nfcmrvl_private *priv,
 	struct nfcmrvl_i2c_drv_data *drv_data = priv->drv_data;
 	int ret;
 
-	if (test_bit(NFCMRVL_PHY_ERROR, &priv->flags))
+	if (test_bit(NFCMRVL_PHY_ERROR, &priv->flags)) {
+		kfree_skb(skb);
 		return -EREMOTEIO;
+	}
 
 	ret = i2c_master_send(drv_data->i2c, skb->data, skb->len);
 
-- 
2.17.1

[PATCH 2/3] nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()

[Shang XiaoJing]

nxp_nci_send() won't free the skb when it failed for the check before
write(). As the result, the skb will memleak. Free the skb when the
check failed.

Fixes: dece45855a8b ("NFC: nxp-nci: Add support for NXP NCI chips")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Suggested-by: Pavel Machek <pavel@denx.de>
---
 drivers/nfc/nxp-nci/core.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/nxp-nci/core.c b/drivers/nfc/nxp-nci/core.c
index 580cb6ecffee..66b198663387 100644
--- a/drivers/nfc/nxp-nci/core.c
+++ b/drivers/nfc/nxp-nci/core.c
@@ -73,11 +73,15 @@ static int nxp_nci_send(struct nci_dev *ndev, struct sk_buff *skb)
 	struct nxp_nci_info *info = nci_get_drvdata(ndev);
 	int r;
 
-	if (!info->phy_ops->write)
+	if (!info->phy_ops->write) {
+		kfree_skb(skb);
 		return -EOPNOTSUPP;
+	}
 
-	if (info->mode != NXP_NCI_MODE_NCI)
+	if (info->mode != NXP_NCI_MODE_NCI) {
+		kfree_skb(skb);
 		return -EINVAL;
+	}
 
 	r = info->phy_ops->write(info->phy_id, skb);
 	if (r < 0) {
-- 
2.17.1

[PATCH 3/3] nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()

[Shang XiaoJing]

s3fwrn5_nci_send() won't free the skb when it failed for the check
before s3fwrn5_write(). As the result, the skb will memleak. Free the
skb when the check failed.

Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
Signed-off-by: Shang XiaoJing <shangxiaojing@huawei.com>
Suggested-by: Pavel Machek <pavel@denx.de>
---
 drivers/nfc/s3fwrn5/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/nfc/s3fwrn5/core.c b/drivers/nfc/s3fwrn5/core.c
index 0270e05b68df..aec356880adf 100644
--- a/drivers/nfc/s3fwrn5/core.c
+++ b/drivers/nfc/s3fwrn5/core.c
@@ -105,6 +105,7 @@ static int s3fwrn5_nci_send(struct nci_dev *ndev, struct sk_buff *skb)
 	mutex_lock(&info->mutex);
 
 	if (s3fwrn5_get_mode(info) != S3FWRN5_MODE_NCI) {
+		kfree_skb(skb);
 		mutex_unlock(&info->mutex);
 		return -EINVAL;
 	}
-- 
2.17.1

Re: [PATCH 0/3] nfc: Fix potential memory leak of skb

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Thu, 17 Nov 2022 19:37:11 +0800 you wrote:
> There are still somewhere maybe leak the skb, fix the memleaks by adding
> fail path.
> 
> Shang XiaoJing (3):
>   nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
>   nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
>   nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
> 
> [...]

Here is the summary with links:
  - [1/3] nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
    https://git.kernel.org/netdev/net/c/e204ead35401
  - [2/3] nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
    https://git.kernel.org/netdev/net/c/614761e1119c
  - [3/3] nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
    https://git.kernel.org/netdev/net/c/60dcb5ff55e5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH 0/3] nfc: Fix potential memory leak of skb

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 323 bytes --]

Hi!

> There are still somewhere maybe leak the skb, fix the memleaks by adding
> fail path.

Thank you!

Reviewed-by: Pavel Machek <pavel@denx.de>

									Pavel

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]