2015-01-15 10:28:27

by Anda-Maria Nicolae

Subject: [RFC PATCH] NFC: st21nfcb: Avoid use of skb after free

Do not insert in send queue the skb that contains unknown Packet Control Byte

Signed-off-by: Anda-Maria Nicolae <[email protected]>
---
Only compile tested, please have a look

drivers/nfc/st21nfcb/ndlc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nfc/st21nfcb/ndlc.c b/drivers/nfc/st21nfcb/ndlc.c
index bac50e8..72659a3 100644
--- a/drivers/nfc/st21nfcb/ndlc.c
+++ b/drivers/nfc/st21nfcb/ndlc.c
@@ -138,7 +138,7 @@ static void llt_ndlc_requeue_data_pending(struct llt_ndlc *ndlc)
default:
pr_err("UNKNOWN Packet Control Byte=%d\n", pcb);
kfree_skb(skb);
- break;
+ continue;
}
skb_queue_head(&ndlc->send_q, skb);
}
--
1.7.9.5

2015-01-15 21:33:52

by Christophe Ricard

Subject: Re: [RFC PATCH] NFC: st21nfcb: Avoid use of skb after free

Hi Anda-Maria,

I agree with your fix. I have built and tested it successfully.
I will include it in a new patch series with a:
Acked-by: Christophe Ricard <[email protected]>

Thanks a lot.
Christophe
On 15/01/2015 11:30, Anda-Maria Nicolae wrote:
> Do not insert in send queue the skb that contains unknown Packet Control Byte
>
> Signed-off-by: Anda-Maria Nicolae <[email protected]>
> ---
> Only compile tested, please have a look
>
> drivers/nfc/st21nfcb/ndlc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nfc/st21nfcb/ndlc.c b/drivers/nfc/st21nfcb/ndlc.c
> index bac50e8..72659a3 100644
> --- a/drivers/nfc/st21nfcb/ndlc.c
> +++ b/drivers/nfc/st21nfcb/ndlc.c
> @@ -138,7 +138,7 @@ static void llt_ndlc_requeue_data_pending(struct llt_ndlc *ndlc)
> default:
> pr_err("UNKNOWN Packet Control Byte=%d\n", pcb);
> kfree_skb(skb);
> - break;
> + continue;
> }
> skb_queue_head(&ndlc->send_q, skb);
> }