浏览代码

NFC: digital: Fix a possible memory leak

This fixes a memory leak issue that may occur if data sending fails in
initiator mode. The data_exch structure was not released in case of
error.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Thierry Escande 11 年之前
父节点
当前提交
6ea7398d00
共有 1 个文件被更改,包括 13 次插入5 次删除
  1. 13 5
      net/nfc/digital_core.c

+ 13 - 5
net/nfc/digital_core.c

@@ -671,19 +671,27 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
 	data_exch->cb = cb;
 	data_exch->cb = cb;
 	data_exch->cb_context = cb_context;
 	data_exch->cb_context = cb_context;
 
 
-	if (ddev->curr_protocol == NFC_PROTO_NFC_DEP)
-		return digital_in_send_dep_req(ddev, target, skb, data_exch);
+	if (ddev->curr_protocol == NFC_PROTO_NFC_DEP) {
+		rc = digital_in_send_dep_req(ddev, target, skb, data_exch);
+		goto exit;
+	}
 
 
 	if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
 	if (ddev->curr_protocol == NFC_PROTO_ISO14443) {
 		rc = digital_in_iso_dep_push_sod(ddev, skb);
 		rc = digital_in_iso_dep_push_sod(ddev, skb);
 		if (rc)
 		if (rc)
-			return rc;
+			goto exit;
 	}
 	}
 
 
 	ddev->skb_add_crc(skb);
 	ddev->skb_add_crc(skb);
 
 
-	return digital_in_send_cmd(ddev, skb, 500, digital_in_send_complete,
-				   data_exch);
+	rc = digital_in_send_cmd(ddev, skb, 500, digital_in_send_complete,
+				 data_exch);
+
+exit:
+	if (rc)
+		kfree(data_exch);
+
+	return rc;
 }
 }
 
 
 static struct nfc_ops digital_nfc_ops = {
 static struct nfc_ops digital_nfc_ops = {