This is a note to let you know that I've just added the patch titled nfc: fix memory leak in llcp_sock_connect() to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: nfc-fix-memory-leak-in-llcp_sock_connect.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 7574fcdbdcb335763b6b322f6928dc0fd5730451 Mon Sep 17 00:00:00 2001 From: Xiaoming Ni <nixiaoming@xxxxxxxxxx> Date: Thu, 25 Mar 2021 11:51:12 +0800 Subject: nfc: fix memory leak in llcp_sock_connect() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Xiaoming Ni <nixiaoming@xxxxxxxxxx> commit 7574fcdbdcb335763b6b322f6928dc0fd5730451 upstream. In llcp_sock_connect(), use kmemdup to allocate memory for "llcp_sock->service_name". The memory is not released in the sock_unlink label of the subsequent failure branch. As a result, memory leakage occurs. fix CVE-2020-25672 Fixes: d646960f7986 ("NFC: Initial LLCP support") Reported-by: "kiyin(尹亮)" <kiyin@xxxxxxxxxxx> Link: https://www.openwall.com/lists/oss-security/2020/11/01/1 Cc: <stable@xxxxxxxxxxxxxxx> #v3.3 Signed-off-by: Xiaoming Ni <nixiaoming@xxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/nfc/llcp_sock.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -757,6 +757,8 @@ sock_unlink: nfc_llcp_local_put(llcp_sock->local); nfc_llcp_sock_unlink(&local->connecting_sockets, sk); + kfree(llcp_sock->service_name); + llcp_sock->service_name = NULL; put_dev: nfc_put_device(dev); Patches currently in stable-queue which might be from nixiaoming@xxxxxxxxxx are queue-4.9/nfc-avoid-endless-loops-caused-by-repeated-llcp_sock_connect.patch queue-4.9/nfc-fix-memory-leak-in-llcp_sock_connect.patch queue-4.9/nfc-fix-refcount-leak-in-llcp_sock_bind.patch queue-4.9/nfc-fix-refcount-leak-in-llcp_sock_connect.patch