Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     krzysztof.kozlowski@canonical.com, davem@davemloft.net,
        kuba@kernel.org, wengjianfeng@yulong.com, dan.carpenter@oracle.com
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
Date:   Fri,  5 Nov 2021 06:18:51 -0700
Message-Id: <20211105131851.30256-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xZIKJhJVYkNc/urUttSoBmyJ1QCrfi32ZR9Ebqnd5qclKtL0aOSV/ibp12Ez?=
 =?us-ascii?Q?3ONiAjjTP4EMtzZfGl9H9xpmgUcI0TsxFnvOtXAHNH0+AGO+ZJc+yEMDw+4E?=
 =?us-ascii?Q?XPq15Z8C2SxaXjzaW2Qrrr8Xmvehzq5FOmZNoAMpjBPv1PuCygr5eovMXtk4?=
 =?us-ascii?Q?7PJloL9GR5xfB0LZ4dS69onUFTkGQgRMY4XPEzhGbkl2ZW+au4ujxe7ES4fb?=
 =?us-ascii?Q?2owvK3tclBHVysa7SHw5aWco5kRhlbC9Wa/g9PAabDha39lFe80wbW5Grykv?=
 =?us-ascii?Q?SnkXEVc09Bh9Eq6mAde/qP5Lvf/iQstPFbFhMVKUMwU37COSLKX0iFlaY4Xo?=
 =?us-ascii?Q?3kiVwsliSLpAJNXcPJcqLvhyyUtVrObSvScMMj7KroiH3TNaeQqtW1RAIbcg?=
 =?us-ascii?Q?u4xh+yuGA82XXGTmBYR5vANn9M6pUb+MmrB0KZjDDEiiJsCxObdVAeU4uv/h?=
 =?us-ascii?Q?qqd+OQ5R0NkTU2Y9p+rDpY+2FzyCRRhz+VFHCeXr/dk4bslrVdaaOTqYD/bM?=
 =?us-ascii?Q?/gg6T7QL/k7tu9tlMqF7Om1ewnxDlcOb8Tu3LdoVVGwsWS/P6dbyii83s2Kb?=
 =?us-ascii?Q?Z9Sbtbc1TeU+/H6uLjEiXhwmfCrI+DHVwxjPQaNouGVlR0ZyrMHaKL4HbVgu?=
 =?us-ascii?Q?GI/pAhg1JoCA4kPkDcaeDFFoBHrrB5S832/LQQMhovbIr8PEee5SXKXsddXZ?=
 =?us-ascii?Q?UNcfgPDknOcbcC5QgkVnv8FvDZ/QDk9d/uMdGkRHNRR2lZCf76UCl/M9N6NQ?=
 =?us-ascii?Q?mQz8k9YDKn5JElW/jb2H3mFlLQXhkBF/WHI2ace8r16toLAeLqmwUlsJw1M8?=
 =?us-ascii?Q?OyLTfi/ExuWCg9f+JhKmY9DwsCb24N3jV4gP+SdkdEzBmbQQsgsP2ATnE2Wx?=
 =?us-ascii?Q?PEW0pWLT1GjqT85drkzZnJkDxKqp6U6/G5pJiy7wRW6VHN1mMjjFVx4UC4Su?=
 =?us-ascii?Q?xctAzRm85eg5BOmo235jSRTD1tk4ma77siU0v4QN42E4kbKsf+4X0dY+0buK?=
 =?us-ascii?Q?vniv4xLtLE2MSu1ew9ZmI/CcQyjIetbmVUOLmFnd41CLYSR6XtusoqtsVrr3?=
 =?us-ascii?Q?sYD/ATvxaQWUas62jeO2r5oZYeEvETNAkuD79j4YRJpzaNSGqEcMR8uyoesz?=
 =?us-ascii?Q?U3VZdGXDfxUkTxR7YHgrhRD0l8uLrvMRMjBuUhWbh3Y3/OJKcHPf6yds2q4s?=
 =?us-ascii?Q?v7An6QUFH5ZX7fI+d//CX3NVidLF87wrirNydbCKI7va9mCfBjLLWOYS9uVZ?=
 =?us-ascii?Q?bnTA6HusO654/Qg47o9tmcSmEY/bccv8L8lDBpCH8FKXOEONmjazHg6IpvIC?=
 =?us-ascii?Q?PwMzrriAx3x+JlU1FkBltfvjTFqUP8N3YEnqQZcmBXo1BAkM0tIkx7hLK/UI?=
 =?us-ascii?Q?h7VaDai7KWlxqqTJLGUBiWYdr8ALG/DSmhX/k6DCT4kQ6acu292b19yhspO1?=
 =?us-ascii?Q?A2lyGZthS4eDoA187DkFTOMOxbZm6I4132C0ivl/E1zYRQF7wnUTGAqF/lWz?=
 =?us-ascii?Q?95InVvt5YJVPfHUFXWuCxtoOhQgKF7pY/HBvu5DAoHJZ+j5Fk+ltHvJ8mdM/?=
 =?us-ascii?Q?PllvX7FeHvsqvSCl9mpWsD00CLyGaEjt7t8yBMIAjDJw+/3l0fhynsYVPCf9?=
 =?us-ascii?Q?WNY1rcXXfSgzzitn+8qkin0=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 618a8ef9-1876-44c3-6edd-08d9a05ed84a
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2021 13:19:06.8629
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: bbT2sz0FiCu/jXfN8s17rlRdvWgFsrVJbugwNf+/QfbsL5Dv9jFD2pw1WokvG10a6khQzNGxJqQJcX6ZLIxpyw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYAP286MB0428
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
but follow error handler branch when pn533_fill_fragment_skbs()
fails, skb is freed again, results in double free issue. Fix this
by not free skb when pn533_fill_fragment_skbs() return value <= 0.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/nfc/pn533/pn533.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index 787bcbd290f7..226ae4357f7f 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2285,8 +2285,10 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
 		/* jumbo frame ? */
 		if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
 			rc = pn533_fill_fragment_skbs(dev, skb);
-			if (rc <= 0)
-				goto error;
+			if (rc <= 0) {
+				kfree(arg);
+				return rc;
+			}
 
 			skb = skb_dequeue(&dev->fragment_skb);
 			if (!skb) {
@@ -2353,8 +2355,11 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 	/* let's split in multiple chunks if size's too big */
 	if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
 		rc = pn533_fill_fragment_skbs(dev, skb);
-		if (rc <= 0)
-			goto error;
+		if (rc <= 0) {
+			if (rc < 0)
+				skb_queue_purge(&dev->fragment_skb);
+			return rc;
+		}
 
 		/* get the first skb */
 		skb = skb_dequeue(&dev->fragment_skb);
-- 
2.17.1