Patch "NFC: st21nfca: fix use of uninitialized variables in error path" has been added to the 4.2-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    NFC: st21nfca: fix use of uninitialized variables in error path

to the 4.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nfc-st21nfca-fix-use-of-uninitialized-variables-in-error-path.patch
and it can be found in the queue-4.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 5a3570061a131309143a49e4bbdbce7e23f261e7 Mon Sep 17 00:00:00 2001
From: Christophe Ricard <christophe.ricard@gmail.com>
Date: Fri, 14 Aug 2015 22:33:33 +0200
Subject: NFC: st21nfca: fix use of uninitialized variables in error path

From: Christophe Ricard <christophe.ricard@gmail.com>

commit 5a3570061a131309143a49e4bbdbce7e23f261e7 upstream.

st21nfca_hci_load_session() calls kfree_skb() on unitialized
variables skb_pipe_info and skb_pipe_list if the call to
nfc_hci_connect_gate() failed. Reword the error path to not use
these variables when they are not initialized. While at it, there
seemed to be a memory leak because skb_pipe_info was only freed
once, after the for-loop, even though several ones were created
by nfc_hci_send_cmd.

Fixes: ec03ff1a8f9a
("NFC: st21nfca: Remove skb_pipe_list and skb_pipe_info
useless allocation")

Acked-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nfc/st21nfca/st21nfca.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/nfc/st21nfca/st21nfca.c
+++ b/drivers/nfc/st21nfca/st21nfca.c
@@ -148,14 +148,14 @@ static int st21nfca_hci_load_session(str
 				ST21NFCA_DEVICE_MGNT_GATE,
 				ST21NFCA_DEVICE_MGNT_PIPE);
 	if (r < 0)
-		goto free_info;
+		return r;
 
 	/* Get pipe list */
 	r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE,
 			ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list),
 			&skb_pipe_list);
 	if (r < 0)
-		goto free_info;
+		return r;
 
 	/* Complete the existing gate_pipe table */
 	for (i = 0; i < skb_pipe_list->len; i++) {
@@ -181,6 +181,7 @@ static int st21nfca_hci_load_session(str
 			info->src_host_id != ST21NFCA_ESE_HOST_ID) {
 			pr_err("Unexpected apdu_reader pipe on host %x\n",
 				info->src_host_id);
+			kfree_skb(skb_pipe_info);
 			continue;
 		}
 
@@ -200,6 +201,7 @@ static int st21nfca_hci_load_session(str
 			hdev->pipes[st21nfca_gates[j].pipe].dest_host =
 							info->src_host_id;
 		}
+		kfree_skb(skb_pipe_info);
 	}
 
 	/*
@@ -214,13 +216,12 @@ static int st21nfca_hci_load_session(str
 					st21nfca_gates[i].gate,
 					st21nfca_gates[i].pipe);
 			if (r < 0)
-				goto free_info;
+				goto free_list;
 		}
 	}
 
 	memcpy(hdev->init_data.gates, st21nfca_gates, sizeof(st21nfca_gates));
-free_info:
-	kfree_skb(skb_pipe_info);
+free_list:
 	kfree_skb(skb_pipe_list);
 	return r;
 }


Patches currently in stable-queue which might be from christophe.ricard@gmail.com are

queue-4.2/nfc-st-nci-fix-typo-when-changing-from-st21nfcb-to-st-nci.patch
queue-4.2/nfc-st-nci-remove-duplicate-file-platform_data-st_nci.h.patch
queue-4.2/nfc-st-nci-fix-non-accurate-comment-for-st_nci_i2c_read.patch
queue-4.2/nfc-st-nci-free-data-with-irrelevant-ndlc-pcb_sync-value.patch
queue-4.2/nfc-st-nci-fix-use-of-uninitialized-variables-in-error-path.patch
queue-4.2/nfc-netlink-warning-fix.patch
queue-4.2/nfc-st-nci-remove-data-from-ack_pending_q-when-receiving-a-sync_ack.patch
queue-4.2/nfc-netlink-add-check-on-nfc_attr_vendor_data.patch
queue-4.2/nfc-nci-hci-add-check-on-skb-nci_hci_send_cmd-parameter.patch
queue-4.2/nfc-st21nfca-fix-use-of-uninitialized-variables-in-error-path.patch