Commit d42449d2 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

nfc: digital: free skb on digital_in_send error paths 



digital_in_send() takes ownership of the skb passed by the caller
(nfc_data_exchange), make sure it's freed on all error paths.

Found looking around the real driver for similar bugs to the one
just fixed in nci.

Fixes: 2c66daec ("NFC Digital: Add NFC-A technology support")
Reviewed-by: default avatarJoe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260303162346.2071888-3-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 7bd4b0c4

net/nfc/digital_core.c

+6 −2
Original line number Diff line number Diff line
@@ -707,8 +707,10 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target, 
	int rc;



	data_exch = kzalloc_obj(*data_exch);

	if (!data_exch)

	if (!data_exch) {

		kfree_skb(skb);

		return -ENOMEM;

	}



	data_exch->cb = cb;

	data_exch->cb_context = cb_context;
@@ -731,8 +733,10 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target, 
				 data_exch);



exit:

	if (rc)

	if (rc) {

		kfree_skb(skb);

		kfree(data_exch);

	}



	return rc;

}