This is a note to let you know that I've just added the patch titled
NFC: st-nci: fix use of uninitialized variables in error path
to the 4.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nfc-st-nci-fix-use-of-uninitialized-variables-in-error-path.patch
and it can be found in the queue-4.2 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From daaf1e1f1640eb11259954d1d847d8a72ab5b938 Mon Sep 17 00:00:00 2001
From: Christophe Ricard <christophe.ricard@xxxxxxxxx>
Date: Fri, 14 Aug 2015 22:33:34 +0200
Subject: NFC: st-nci: fix use of uninitialized variables in error path
From: Christophe Ricard <christophe.ricard@xxxxxxxxx>
commit daaf1e1f1640eb11259954d1d847d8a72ab5b938 upstream.
st_nci_hci_load_session() calls kfree_skb() on unitialized
variables skb_pipe_info and skb_pipe_list if the call to
nci_hci_connect_gate() failed. Reword the error path to not use
these variables when they are not initialized. While at it, there
seemed to be a memory leak because skb_pipe_info was only freed
once, after the for-loop, even though several ones were created
by nci_hci_send_cmd.
Acked-by: Christophe Ricard <christophe-h.ricard@xxxxxx>
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@xxxxxxx>
Signed-off-by: Samuel Ortiz <sameo@xxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/nfc/st-nci/st-nci_se.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/nfc/st-nci/st-nci_se.c
+++ b/drivers/nfc/st-nci/st-nci_se.c
@@ -189,14 +189,14 @@ int st_nci_hci_load_session(struct nci_d
ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DEVICE_MGNT_PIPE);
if (r < 0)
- goto free_info;
+ return r;
/* Get pipe list */
r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DM_GETINFO, pipe_list, sizeof(pipe_list),
&skb_pipe_list);
if (r < 0)
- goto free_info;
+ return r;
/* Complete the existing gate_pipe table */
for (i = 0; i < skb_pipe_list->len; i++) {
@@ -222,6 +222,7 @@ int st_nci_hci_load_session(struct nci_d
dm_pipe_info->src_host_id != ST_NCI_ESE_HOST_ID) {
pr_err("Unexpected apdu_reader pipe on host %x\n",
dm_pipe_info->src_host_id);
+ kfree_skb(skb_pipe_info);
continue;
}
@@ -241,13 +242,12 @@ int st_nci_hci_load_session(struct nci_d
ndev->hci_dev->pipes[st_nci_gates[j].pipe].host =
dm_pipe_info->src_host_id;
}
+ kfree_skb(skb_pipe_info);
}
memcpy(ndev->hci_dev->init_data.gates, st_nci_gates,
sizeof(st_nci_gates));
-free_info:
- kfree_skb(skb_pipe_info);
kfree_skb(skb_pipe_list);
return r;
}
Patches currently in stable-queue which might be from christophe.ricard@xxxxxxxxx are
queue-4.2/nfc-st-nci-fix-typo-when-changing-from-st21nfcb-to-st-nci.patch
queue-4.2/nfc-st-nci-remove-duplicate-file-platform_data-st_nci.h.patch
queue-4.2/nfc-st-nci-fix-non-accurate-comment-for-st_nci_i2c_read.patch
queue-4.2/nfc-st-nci-free-data-with-irrelevant-ndlc-pcb_sync-value.patch
queue-4.2/nfc-st-nci-fix-use-of-uninitialized-variables-in-error-path.patch
queue-4.2/nfc-netlink-warning-fix.patch
queue-4.2/nfc-st-nci-remove-data-from-ack_pending_q-when-receiving-a-sync_ack.patch
queue-4.2/nfc-netlink-add-check-on-nfc_attr_vendor_data.patch
queue-4.2/nfc-nci-hci-add-check-on-skb-nci_hci_send_cmd-parameter.patch
queue-4.2/nfc-st21nfca-fix-use-of-uninitialized-variables-in-error-path.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html