Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chengfeng Ye <cyeaa@connect.ust.hk>
To:     krzysztof.kozlowski@canonical.com, davem@davemloft.net,
        kuba@kernel.org, wengjianfeng@yulong.com, dan.carpenter@oracle.com
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        Chengfeng Ye <cyeaa@connect.ust.hk>
Subject: [PATCH v2] nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
Date:   Fri,  5 Nov 2021 06:36:36 -0700
Message-Id: <20211105133636.31282-1-cyeaa@connect.ust.hk>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?vJsGyPMYb08D9iod+KkbW+f458ubtEzYUDVnc1Am7npq/N3WFQMClh5DEEJQ?=
 =?us-ascii?Q?IED+HVob7Cyki03MPHmaS9Q0y/2KOQ7japsw7iwhQ8SmW5dtfRD83Uj692Yj?=
 =?us-ascii?Q?F2f/WbuzgbfQmIboTGWp6poS3ZrZ85eWL2PBf2mjxY67xj7Fx1dMvNdu+evv?=
 =?us-ascii?Q?U3yxCWoK/DsE1EtzYg3wXpjXZInBoW+7PDAd4aMrJONn/uYHiNdfRLTjtROZ?=
 =?us-ascii?Q?zEIPN6zDLkavs4C0UN9Ok1C1OBExkI7MUBJw9UIUT9PaolZsZIGxeCbAgEXx?=
 =?us-ascii?Q?a0kB4JQSNvhkdBSev7aO8IBBOpJSMhfPUlZQM2xga1PP6xzIMNg9ulhe2hcb?=
 =?us-ascii?Q?YR7KySeNdSWZ5+adN9NmqljqM9PXmkqzHZwIv403nV2UDjPEnzb9lfiMU/bE?=
 =?us-ascii?Q?S+vKaN9ibInsE1XfKikKlqSl4PlNd5SnQjJkAZlrXCLC+PNzwJ7HGoE0Gcqc?=
 =?us-ascii?Q?oUy3jPq5hd4udOyuVD+zpSvECSDaS7WanlFhBINXZjIcMO1tCH+3mnXD2ygH?=
 =?us-ascii?Q?e9vSoVadii6V7dv2vhS66iSxuDg/EBnOoOnLkYgIWJMFWdYRrm7HbPvFj0aF?=
 =?us-ascii?Q?Q69zBzH+2gKn1OV+CwpYjeZ2lo2CvAFhdr14EpiOB533EtUjhOb8lzeFasRU?=
 =?us-ascii?Q?rtkezUpF02h4ZMxoWvmVSjilLTZP9FOmGv6kd5y6JANoyAw+08vWbmPctlMK?=
 =?us-ascii?Q?9VvuR3eJ2uzt1tnt+zsfCRTmg9uKeR8y14T8aF+p9uONjviInEP7W2RWfR5S?=
 =?us-ascii?Q?6kLFsqsFD65Krxlu3X0P3BGY5GBKRBAAdYmiqlLDznn61i/2yvmQmHlJ0SrH?=
 =?us-ascii?Q?k1gABtk3xvzDFc0IXInoAtKUJv8La04AxdjII1yHRoeJwg/6VTSFl8joLGfB?=
 =?us-ascii?Q?02T+SCQUywKtWOpAIDKZMYHEUAmi9trScHh33aVrCkWbgphnH6pdCtExBEym?=
 =?us-ascii?Q?FUKkJkGPtiQgn7PszUdIa0jAYQVzm3P1fiUGBDXMxxrg3mEPw4gQX2KSfs8x?=
 =?us-ascii?Q?qPlTjWUSik4JdXCuGXeG1FO6j4EPmjJjCrZgyNNYgCuxsPBiJEDcHMTuPVLQ?=
 =?us-ascii?Q?Qn69P9uCa3HgmMyi7l8/xh27XaAvFI6jPhK0/aBiHzN14WefhWHExEcyv55y?=
 =?us-ascii?Q?nZlK1/BUzRR0zUtibKaVNoDeAYi6peIMQgTun68H1nQnXvYF1a4I4Hdr4aPU?=
 =?us-ascii?Q?kl198zQNzKA6eUNvSGi1wBIdxObTXPByW+ta4oowpAKgSdlKDUfOrQOwCan1?=
 =?us-ascii?Q?qkxD80IaPb7tnmtsYD2R99/cntgdko2TQoc0KPI1eibwenbbtoPXJICjI1KD?=
 =?us-ascii?Q?KgbgAn9fNf4h+GSI5kLpq8rj0yiI5wJ6jBSxKP+/w4YKjDxVJUbB9q+J+uII?=
 =?us-ascii?Q?XEqt2c9gvaU99oHwasB6oKW2PPLYrOnvonsubgg9qoaADKWTuJD2BFEdTFSm?=
 =?us-ascii?Q?c35F4nvf8GzSWEzmTiHJYW4DPpFsu0QrqSOjiM63z7yw06RIivcyA3Lmyhy2?=
 =?us-ascii?Q?sBJDvql8Zmwe7mIuP9aYM6L7PENmGlCCOip5nuWYtKnN6OdPY3ZpCK/DVOHl?=
 =?us-ascii?Q?dF4ES+9j7OlOZp2+TQNXfCjPVUsJTkrzKiXpngWo7v79cB6DlPlvnkVe3hyw?=
 =?us-ascii?Q?92LmDfhCP3V9OTCyCJZADbM=3D?=
X-OriginatorOrg: connect.ust.hk
X-MS-Exchange-CrossTenant-Network-Message-Id: 2db9c7db-57fd-4a10-5d26-08d9a0614f6d
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB1188.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2021 13:36:45.6177
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6c1d4152-39d0-44ca-88d9-b8d6ddca0708
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: T603hoSy8UBoxjiQg5Xc0Fi1xxKBVc7MN8iYbhCcYQ5H392ZQf5Q+6yasO+VnorEtpcxM/WyLs73YX5Wfh6XtA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYYP286MB1248
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
but follow error handler branch when pn533_fill_fragment_skbs()
fails, skb is freed again, results in double free issue. Fix this
by not free skb in error path of pn533_fill_fragment_skbs.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
---
 drivers/nfc/pn533/pn533.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index 787bcbd290f7..a491db46e3bd 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2216,7 +2216,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
 		frag = pn533_alloc_skb(dev, frag_size);
 		if (!frag) {
 			skb_queue_purge(&dev->fragment_skb);
-			break;
+			return -ENOMEM;
 		}
 
 		if (!dev->tgt_mode) {
@@ -2285,7 +2285,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
 		/* jumbo frame ? */
 		if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
 			rc = pn533_fill_fragment_skbs(dev, skb);
-			if (rc <= 0)
+			if (rc < 0)
 				goto error;
 
 			skb = skb_dequeue(&dev->fragment_skb);
@@ -2353,7 +2353,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 	/* let's split in multiple chunks if size's too big */
 	if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
 		rc = pn533_fill_fragment_skbs(dev, skb);
-		if (rc <= 0)
+		if (rc < 0)
 			goto error;
 
 		/* get the first skb */
-- 
2.17.1