diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-03-03 08:23:42 -0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-03-04 18:16:10 -0800 |
| commit | d42449d2c17cdf06d1f63268557450bd3f051e9a (patch) | |
| tree | e546f1d1b36f12a584d5ddf8af24905a2034b371 | |
| parent | 7bd4b0c4779f978a6528c9b7937d2ca18e936e2c (diff) | |
nfc: digital: free skb on digital_in_send error paths
digital_in_send() takes ownership of the skb passed by the caller
(nfc_data_exchange), make sure it's freed on all error paths.
Found looking around the real driver for similar bugs to the one
just fixed in nci.
Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support")
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260303162346.2071888-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/nfc/digital_core.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c index 3670bb33732e..7cb1e6aaae90 100644 --- a/net/nfc/digital_core.c +++ b/net/nfc/digital_core.c @@ -707,8 +707,10 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target, int rc; data_exch = kzalloc_obj(*data_exch); - if (!data_exch) + if (!data_exch) { + kfree_skb(skb); return -ENOMEM; + } data_exch->cb = cb; data_exch->cb_context = cb_context; @@ -731,8 +733,10 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target, data_exch); exit: - if (rc) + if (rc) { + kfree_skb(skb); kfree(data_exch); + } return rc; } |