Commit 5c14a19d authored Apr 02, 2026 by Pengpeng Hou Committed by Jakub Kicinski Apr 03, 2026

nfc: s3fwrn5: allocate rx skb before consuming bytes

s3fwrn82_uart_read() reports the number of accepted bytes to the serdev
core. The current code consumes bytes into recv_skb and may already
deliver a complete frame before allocating a fresh receive buffer.

If that alloc_skb() fails, the callback returns 0 even though it has
already consumed bytes, and it leaves recv_skb as NULL for the next
receive callback. That breaks the receive_buf() accounting contract and
can also lead to a NULL dereference on the next skb_put_u8().

Allocate the receive skb lazily before consuming the next byte instead.
If allocation fails, return the number of bytes already accepted.

Fixes: 3f52c2cb ("nfc: s3fwrn5: Support a UART interface")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260402042148.65236-1-pengpeng@iscas.ac.cn

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 77facb35

drivers/nfc/s3fwrn5/uart.c

+7 −3

Original line number	Diff line number	Diff line
		@@ -58,6 +58,12 @@ static size_t s3fwrn82_uart_read(struct serdev_device *serdev,
		size_t i;

		for (i = 0; i < count; i++) {
		if (!phy->recv_skb) {
		phy->recv_skb = alloc_skb(NCI_SKB_BUFF_LEN, GFP_KERNEL);
		if (!phy->recv_skb)
		return i;
		}

		skb_put_u8(phy->recv_skb, *data++);

		if (phy->recv_skb->len < S3FWRN82_NCI_HEADER)
		@@ -69,9 +75,7 @@ static size_t s3fwrn82_uart_read(struct serdev_device *serdev,

		s3fwrn5_recv_frame(phy->common.ndev, phy->recv_skb,
		phy->common.mode);
		phy->recv_skb = alloc_skb(NCI_SKB_BUFF_LEN, GFP_KERNEL);
		if (!phy->recv_skb)
		return 0;
		phy->recv_skb = NULL;
		}

		return i;