From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB21937416E; Thu, 12 Mar 2026 20:28:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773347320; cv=none; b=GomUYaD4K8zu7aQAhtBdy0m43DAZeSCkkMUAiytwVCKm9uHWl9GhyrODqtl11oRmJEV0g//LLRZebSq/XmhdXBlq6QMFg0LTjA0U5/hi1kBvWxilOMHMk1cys0uS3C5gsHv5FWhJD+5TyMjvVllp+LRF3zV5c9S1sV70UqdupxI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773347320; c=relaxed/simple; bh=qh+SjPR8A/VeIIaWARxv1w01SUyf7V/qe4GZ3VV2To8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hGeOdZTGNzT9rhGVGHreyrYBCjbC12HMGuDlF280Xprq4TxdfEf8sSgFJ+tk2g36oSNfSDMsQqZY8nTyeQyvh3PCoNSDHnLGz//mXiU5vrnSlqwkvXOhD8lj6ScKMdsm6DrXwd2JBC5+1lIEtRjPSMqBp0T+MMDau+rZpz+dUms= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2cZgVTLE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2cZgVTLE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4098DC2BC86; Thu, 12 Mar 2026 20:28:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1773347320; bh=qh+SjPR8A/VeIIaWARxv1w01SUyf7V/qe4GZ3VV2To8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2cZgVTLEXYvPj7n2hmtpJ+/K2De4gV3DsWzeDs9/tn698pe2JccSPvJHcf/ZIwLTK JHYbQFdo5u7nYqGeU2WkdwKhxqlClvx5IvY0otAH2iwKOB5KrfmQaDUu8hPZmNDNg3 ySbuvj7yh56Ta9zn5qcpYaThtMSOJTXHufwA5PQI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Joe Damato , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.12 230/265] nfc: nci: free skb on nci_transceive early error paths Date: Thu, 12 Mar 2026 21:10:17 +0100 Message-ID: <20260312201026.637287555@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260312201018.128816016@linuxfoundation.org> References: <20260312201018.128816016@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jakub Kicinski [ Upstream commit 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c ] nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks: unreferenced object 0xff11000015ce6a40 (size 640): comm "nci_dev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmem_cache_alloc_node_noprof+0x492/0x630 __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xc6/0x8f0 sock_alloc_send_pskb+0x326/0x3f0 nfc_alloc_send_skb+0x94/0x1d0 rawsock_sendmsg+0x162/0x4c0 do_syscall_64+0x117/0xfc0 Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/nfc/nci/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 3c42b149c729c..18ff1c23769ae 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -1024,18 +1024,23 @@ static int nci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target, struct nci_conn_info *conn_info; conn_info = ndev->rf_conn_info; - if (!conn_info) + if (!conn_info) { + kfree_skb(skb); return -EPROTO; + } pr_debug("target_idx %d, len %d\n", target->idx, skb->len); if (!ndev->target_active_prot) { pr_err("unable to exchange data, no active target\n"); + kfree_skb(skb); return -EINVAL; } - if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags)) + if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags)) { + kfree_skb(skb); return -EBUSY; + } /* store cb and context to be used on receiving data */ conn_info->data_exchange_cb = cb; -- 2.51.0