A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 10:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling

Browse source 
commit 996419e0594abb311fb958553809f24f38e7abbe upstream.

Error paths do not free previously allocated memory. Add devm_kfree() to
those failure paths.

Fixes: 26fc6c7f02 ("NFC: st21nfca: Add HCI transaction event support")
Fixes: 4fbcc1a4cb20 ("nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION")
Cc: [email protected]
Signed-off-by: Martin Faltesek <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This commit is contained in:
Martin Faltesek 2022-06-06 21:57:28 -05:00 • committed by Greg Kroah-Hartman
commit 3eca2c42da
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/nfc/st21nfca/se.c
View file

@ -331,22 +331,29 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
transaction->aid_len = skb->data[1];
/* Checking if the length of the AID is valid */
if (transaction->aid_len > sizeof(transaction->aid))
if (transaction->aid_len > sizeof(transaction->aid)) {
devm_kfree(dev, transaction);
return -EINVAL;
}
memcpy(transaction->aid, &skb->data[2],
transaction->aid_len);
/* Check next byte is PARAMETERS tag (82) */
if (skb->data[transaction->aid_len + 2] !=
NFC_EVT_TRANSACTION_PARAMS_TAG)
NFC_EVT_TRANSACTION_PARAMS_TAG) {
devm_kfree(dev, transaction);
return -EPROTO;
}
transaction->params_len = skb->data[transaction->aid_len + 3];
/* Total size is allocated (skb->len - 2) minus fixed array members */
if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
if (transaction->params_len > ((skb->len - 2) -
sizeof(struct nfc_evt_transaction))) {
devm_kfree(dev, transaction);
return -EINVAL;
}
memcpy(transaction->params, skb->data +
transaction->aid_len + 4, transaction->params_len);