Patch "nfc: fix memory leak of se_io context in nfc_genl_se_io" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    nfc: fix memory leak of se_io context in nfc_genl_se_io

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     nfc-fix-memory-leak-of-se_io-context-in-nfc_genl_se_.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a382a624bda800d5f865897262dae914f2d4f9d3
Author: Fedor Pchelkin <pchelkin@xxxxxxxxx>
Date:   Sat Feb 25 13:56:14 2023 +0300

    nfc: fix memory leak of se_io context in nfc_genl_se_io
    
    [ Upstream commit 25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea ]
    
    The callback context for sending/receiving APDUs to/from the selected
    secure element is allocated inside nfc_genl_se_io and supposed to be
    eventually freed in se_io_cb callback function. However, there are several
    error paths where the bwi_timer is not charged to call se_io_cb later, and
    the cb_context is leaked.
    
    The patch proposes to free the cb_context explicitly on those error paths.
    
    At the moment we can't simply check 'dev->ops->se_io()' return value as it
    may be negative in both cases: when the timer was charged and was not.
    
    Fixes: 5ce3f32b5264 ("NFC: netlink: SE API implementation")
    Reported-by: syzbot+df64c0a2e8d68e78a4fa@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx>
    Signed-off-by: Alexey Khoroshilov <khoroshilov@xxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
index 04a2cea6d6b61..57d09dbf627b4 100644
--- a/drivers/nfc/st-nci/se.c
+++ b/drivers/nfc/st-nci/se.c
@@ -674,6 +674,12 @@ int st_nci_se_io(struct nci_dev *ndev, u32 se_idx,
 					ST_NCI_EVT_TRANSMIT_DATA, apdu,
 					apdu_length);
 	default:
+		/* Need to free cb_context here as at the moment we can't
+		 * clearly indicate to the caller if the callback function
+		 * would be called (and free it) or not. In both cases a
+		 * negative value may be returned to the caller.
+		 */
+		kfree(cb_context);
 		return -ENODEV;
 	}
 }
diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
index d416365042462..6a1d3b2752fbf 100644
--- a/drivers/nfc/st21nfca/se.c
+++ b/drivers/nfc/st21nfca/se.c
@@ -236,6 +236,12 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx,
 					ST21NFCA_EVT_TRANSMIT_DATA,
 					apdu, apdu_length);
 	default:
+		/* Need to free cb_context here as at the moment we can't
+		 * clearly indicate to the caller if the callback function
+		 * would be called (and free it) or not. In both cases a
+		 * negative value may be returned to the caller.
+		 */
+		kfree(cb_context);
 		return -ENODEV;
 	}
 }
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index d928d5a24bbc1..9ba3676ab37f4 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1442,7 +1442,11 @@ static int nfc_se_io(struct nfc_dev *dev, u32 se_idx,
 	rc = dev->ops->se_io(dev, se_idx, apdu,
 			apdu_length, cb, cb_context);
 
+	device_unlock(&dev->dev);
+	return rc;
+
 error:
+	kfree(cb_context);
 	device_unlock(&dev->dev);
 	return rc;
 }