From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:41422 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760098AbbIWEPm (ORCPT ); Wed, 23 Sep 2015 00:15:42 -0400 Subject: Patch "NFC: st21nfca: fix use of uninitialized variables in error path" has been added to the 4.2-stable tree To: christophe.ricard@gmail.com, christophe-h.ricard@st.com, gregkh@linuxfoundation.org, nicolas.iooss_linux@m4x.org, sameo@linux.intel.com Cc: , From: Date: Tue, 22 Sep 2015 21:15:01 -0700 Message-ID: <1442981701171177@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled NFC: st21nfca: fix use of uninitialized variables in error path to the 4.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: nfc-st21nfca-fix-use-of-uninitialized-variables-in-error-path.patch and it can be found in the queue-4.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 5a3570061a131309143a49e4bbdbce7e23f261e7 Mon Sep 17 00:00:00 2001 From: Christophe Ricard Date: Fri, 14 Aug 2015 22:33:33 +0200 Subject: NFC: st21nfca: fix use of uninitialized variables in error path From: Christophe Ricard commit 5a3570061a131309143a49e4bbdbce7e23f261e7 upstream. st21nfca_hci_load_session() calls kfree_skb() on unitialized variables skb_pipe_info and skb_pipe_list if the call to nfc_hci_connect_gate() failed. Reword the error path to not use these variables when they are not initialized. While at it, there seemed to be a memory leak because skb_pipe_info was only freed once, after the for-loop, even though several ones were created by nfc_hci_send_cmd. Fixes: ec03ff1a8f9a ("NFC: st21nfca: Remove skb_pipe_list and skb_pipe_info useless allocation") Acked-by: Christophe Ricard Signed-off-by: Nicolas Iooss Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman --- drivers/nfc/st21nfca/st21nfca.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) --- a/drivers/nfc/st21nfca/st21nfca.c +++ b/drivers/nfc/st21nfca/st21nfca.c @@ -148,14 +148,14 @@ static int st21nfca_hci_load_session(str ST21NFCA_DEVICE_MGNT_GATE, ST21NFCA_DEVICE_MGNT_PIPE); if (r < 0) - goto free_info; + return r; /* Get pipe list */ r = nfc_hci_send_cmd(hdev, ST21NFCA_DEVICE_MGNT_GATE, ST21NFCA_DM_GETINFO, pipe_list, sizeof(pipe_list), &skb_pipe_list); if (r < 0) - goto free_info; + return r; /* Complete the existing gate_pipe table */ for (i = 0; i < skb_pipe_list->len; i++) { @@ -181,6 +181,7 @@ static int st21nfca_hci_load_session(str info->src_host_id != ST21NFCA_ESE_HOST_ID) { pr_err("Unexpected apdu_reader pipe on host %x\n", info->src_host_id); + kfree_skb(skb_pipe_info); continue; } @@ -200,6 +201,7 @@ static int st21nfca_hci_load_session(str hdev->pipes[st21nfca_gates[j].pipe].dest_host = info->src_host_id; } + kfree_skb(skb_pipe_info); } /* @@ -214,13 +216,12 @@ static int st21nfca_hci_load_session(str st21nfca_gates[i].gate, st21nfca_gates[i].pipe); if (r < 0) - goto free_info; + goto free_list; } } memcpy(hdev->init_data.gates, st21nfca_gates, sizeof(st21nfca_gates)); -free_info: - kfree_skb(skb_pipe_info); +free_list: kfree_skb(skb_pipe_list); return r; } Patches currently in stable-queue which might be from christophe.ricard@gmail.com are queue-4.2/nfc-st-nci-fix-typo-when-changing-from-st21nfcb-to-st-nci.patch queue-4.2/nfc-st-nci-remove-duplicate-file-platform_data-st_nci.h.patch queue-4.2/nfc-st-nci-fix-non-accurate-comment-for-st_nci_i2c_read.patch queue-4.2/nfc-st-nci-free-data-with-irrelevant-ndlc-pcb_sync-value.patch queue-4.2/nfc-st-nci-fix-use-of-uninitialized-variables-in-error-path.patch queue-4.2/nfc-netlink-warning-fix.patch queue-4.2/nfc-st-nci-remove-data-from-ack_pending_q-when-receiving-a-sync_ack.patch queue-4.2/nfc-netlink-add-check-on-nfc_attr_vendor_data.patch queue-4.2/nfc-nci-hci-add-check-on-skb-nci_hci_send_cmd-parameter.patch queue-4.2/nfc-st21nfca-fix-use-of-uninitialized-variables-in-error-path.patch