Re: [PATCH net 1/5] nfc: nci: free skb on nci_transceive early error paths

[Joe Damato <joe@dama.to>]

On Tue, Mar 03, 2026 at 08:23:41AM -0800, Jakub Kicinski wrote:
> nci_transceive() takes ownership of the skb passed by the caller,
> but the -EPROTO, -EINVAL, and -EBUSY error paths return without
> freeing it.
> 
> Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes
> the nci/nci_dev selftest hits the error path occasionally in NIPA,
> and kmemleak detects leaks:
> 
> unreferenced object 0xff11000015ce6a40 (size 640):
>   comm "nci_dev", pid 3954, jiffies 4295441246
>   hex dump (first 32 bytes):
>     6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b  kkkk.......kkkkk
>     6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
>   backtrace (crc 7c40cc2a):
>     kmem_cache_alloc_node_noprof+0x492/0x630
>     __alloc_skb+0x11e/0x5f0
>     alloc_skb_with_frags+0xc6/0x8f0
>     sock_alloc_send_pskb+0x326/0x3f0
>     nfc_alloc_send_skb+0x94/0x1d0
>     rawsock_sendmsg+0x162/0x4c0
>     do_syscall_64+0x117/0xfc0
> 
> Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
>  net/nfc/nci/core.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 

Reviewed-by: Joe Damato <joe@dama.to>