From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 87DFC23BD1D; Mon, 23 Mar 2026 15:00:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774278003; cv=none; b=ehIqs/EzAOS0j0U6fO/zYfvlQHn0U1wXNS+lcM3GN2qk3hEsD7UzN/ZBTNF/wvzF0g6LA5nxiiEceJSN8OJoOMAWpYJmYXRZ5Othv3MfvdAzw7yxG3IHV/SowT9a7PNxuuhjYPC53x2TDkHEKgO3xY+a9OyOKmXHUQ8qVkUruWY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774278003; c=relaxed/simple; bh=NL8VYG7z3+OB7OvTH7qRHq5VnaISNiTXLO/L17EIFkY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OkEk9QaChTgRui7+i8VtRHCItdhIcBxAYPj8aesUZhMql7HwvuJBBu1uKvGxNiCgyGJqm10WZg8brCAJZR/2xXMNLB+LH9BeRojY2wXETLOoodlOaMDvNc2hKfhjUMuRcfCWbK9s4oo95EJolrNlNAvkbJ7lZe3faoMsF746rg8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mOkxiBtY; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mOkxiBtY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BCBA2C4CEF7; Mon, 23 Mar 2026 15:00:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774278003; bh=NL8VYG7z3+OB7OvTH7qRHq5VnaISNiTXLO/L17EIFkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mOkxiBtYeGzEyZSBciLwI3kw7piu4QIAFIPPVCKp51S0YccHxhR5y1qEchRIzmsjJ 4fFvri+uqvQ+zLbm3kh/AD2XJqSMrk7DqBOPcom+Q7+JDj8R6QtFtrXj+TpRE/EXGp uHUneAbP0CQjwH8+IpJiXmy1OmYTIQ5FHxxpOMKQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Joe Damato , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.6 169/567] nfc: nci: free skb on nci_transceive early error paths Date: Mon, 23 Mar 2026 14:41:29 +0100 Message-ID: <20260323134538.013744814@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260323134533.749096647@linuxfoundation.org> References: <20260323134533.749096647@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jakub Kicinski [ Upstream commit 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c ] nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCI_DATA_EXCHANGE fixed by subsequent changes the nci/nci_dev selftest hits the error path occasionally in NIPA, and kmemleak detects leaks: unreferenced object 0xff11000015ce6a40 (size 640): comm "nci_dev", pid 3954, jiffies 4295441246 hex dump (first 32 bytes): 6b 6b 6b 6b 00 a4 00 0c 02 e1 03 6b 6b 6b 6b 6b kkkk.......kkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace (crc 7c40cc2a): kmem_cache_alloc_node_noprof+0x492/0x630 __alloc_skb+0x11e/0x5f0 alloc_skb_with_frags+0xc6/0x8f0 sock_alloc_send_pskb+0x326/0x3f0 nfc_alloc_send_skb+0x94/0x1d0 rawsock_sendmsg+0x162/0x4c0 do_syscall_64+0x117/0xfc0 Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reviewed-by: Joe Damato Link: https://patch.msgid.link/20260303162346.2071888-2-kuba@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- net/nfc/nci/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 7a4742a092626..1f33da345bea6 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -1024,18 +1024,23 @@ static int nci_transceive(struct nfc_dev *nfc_dev, struct nfc_target *target, struct nci_conn_info *conn_info; conn_info = ndev->rf_conn_info; - if (!conn_info) + if (!conn_info) { + kfree_skb(skb); return -EPROTO; + } pr_debug("target_idx %d, len %d\n", target->idx, skb->len); if (!ndev->target_active_prot) { pr_err("unable to exchange data, no active target\n"); + kfree_skb(skb); return -EINVAL; } - if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags)) + if (test_and_set_bit(NCI_DATA_EXCHANGE, &ndev->flags)) { + kfree_skb(skb); return -EBUSY; + } /* store cb and context to be used on receiving data */ conn_info->data_exchange_cb = cb; -- 2.51.0