This is a note to let you know that I've just added the patch titled NFC: nci: memory leak in nci_core_conn_create() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: nfc-nci-memory-leak-in-nci_core_conn_create.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From c6dc65d885b98898bf287aaf44e020077b41769f Mon Sep 17 00:00:00 2001 From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Date: Wed, 23 Dec 2015 23:45:27 +0100 Subject: NFC: nci: memory leak in nci_core_conn_create() From: Dan Carpenter <dan.carpenter@xxxxxxxxxx> commit c6dc65d885b98898bf287aaf44e020077b41769f upstream. I've moved the check for "number_destination_params" forward a few lines to avoid leaking "cmd". Fixes: caa575a86ec1 ('NFC: nci: fix possible crash in nci_core_conn_create') Acked-by: Christophe Ricard <christophe-h.ricard@xxxxxx> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Signed-off-by: Samuel Ortiz <sameo@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/nfc/nci/core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -610,14 +610,14 @@ int nci_core_conn_create(struct nci_dev struct nci_core_conn_create_cmd *cmd; struct core_conn_create_data data; + if (!number_destination_params) + return -EINVAL; + data.length = params_len + sizeof(struct nci_core_conn_create_cmd); cmd = kzalloc(data.length, GFP_KERNEL); if (!cmd) return -ENOMEM; - if (!number_destination_params) - return -EINVAL; - cmd->destination_type = destination_type; cmd->number_destination_params = number_destination_params; memcpy(cmd->params, params, params_len); Patches currently in stable-queue which might be from dan.carpenter@xxxxxxxxxx are queue-4.4/mips-rm7000-double-locking-bug-in-rm7k_tc_disable.patch queue-4.4/btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch queue-4.4/xprtrdma-checking-for-null-instead-of-is_err.patch queue-4.4/asoc-intel-pass-correct-parameter-in-sst_alloc_stream_mrfld.patch queue-4.4/mips-octeon-off-by-one-in-octeon_irq_gpio_map.patch queue-4.4/nfc-nci-memory-leak-in-nci_core_conn_create.patch queue-4.4/bpf-mips-fix-off-by-one-in-ctx-offset-allocation.patch queue-4.4/mdio-sun4i-oops-in-error-handling-in-probe.patch queue-4.4/x86-apic-uv-silence-a-shift-wrapping-warning.patch