netdev - [PATCH 0/4] nfc: Fix potential memory leak of skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 27 Oct 2022 22:03:28 +0800
From:   Shang XiaoJing <shangxiaojing@...wei.com>
To:     <krzysztof.kozlowski@...aro.org>,
        <sebastian.reichel@...labora.com>, <peda@...ntia.se>,
        <khalasa@...p.pl>, <kuba@...nel.org>,
        <u.kleine-koenig@...gutronix.de>, <michael@...le.cc>,
        <sameo@...ux.intel.com>, <robert.dolca@...el.com>,
        <clement.perrochaud@....com>, <r.baldyga@...sung.com>,
        <cuissard@...vell.com>, <netdev@...r.kernel.org>
CC:     <shangxiaojing@...wei.com>
Subject: [PATCH 0/4] nfc: Fix potential memory leak of skb

There are 6 kinds of send functions can be called by nci_send_frame():
	virtual_nci_send(),
	fdp_nci_send(),
	nxp_nci_send(),
	s3fwrn5_nci_send(),
	nfcmrvl_nci_send(),
	st_nci_send();

1. virtual_nci_send() will memleak the skb, and has been fixed before.

2. fdp_nci_send() won't free the skb no matter whether write() succeed.

3-4. nxp_nci_send() and s3fwrn5_nci_send() will only free the skb when
write() failed, however write() will not free the skb by itself for when
succeeds.

5. nfcmrvl_nci_send() will call nfcmrvl_XXX_nci_send(), where some of
them will free the skb, but nfcmrvl_i2c_nci_send() only free the skb
when i2c_master_send() return >=0, and memleak will happen when
i2c_master_send() failed in nfcmrvl_i2c_nci_send().

6. st_nci_send() will queue the skb into other list and finally be
freed.

Fix the potential memory leak of skb.

Shang XiaoJing (4):
  nfc: fdp: Fix potential memory leak in fdp_nci_send()
  nfc: nxp-nci: Fix potential memory leak in nxp_nci_send()
  nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
  nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()

 drivers/nfc/fdp/fdp.c      | 10 +++++++++-
 drivers/nfc/nfcmrvl/i2c.c  |  7 ++++++-
 drivers/nfc/nxp-nci/core.c |  7 +++++--
 drivers/nfc/s3fwrn5/core.c |  8 ++++++--
 4 files changed, 26 insertions(+), 6 deletions(-)

-- 
2.17.1