• Liu Shixin's avatar
    NFC: nci: fix memory leak in nci_rx_data_packet() · 53270fb0
    Liu Shixin authored
    Syzbot reported a memory leak about skb:
    
    unreferenced object 0xffff88810e144e00 (size 240):
      comm "syz-executor284", pid 3701, jiffies 4294952403 (age 12.620s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      backtrace:
        [<ffffffff83ab79a9>] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:497
        [<ffffffff82a5cf64>] alloc_skb include/linux/skbuff.h:1267 [inline]
        [<ffffffff82a5cf64>] virtual_ncidev_write+0x24/0xe0 drivers/nfc/virtual_ncidev.c:116
        [<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:759 [inline]
        [<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:743 [inline]
        [<ffffffff815f6503>] do_iter_write+0x253/0x300 fs/read_write.c:863
        [<ffffffff815f66ed>] vfs_writev+0xdd/0x240 fs/read_write.c:934
        [<ffffffff815f68f6>] do_writev+0xa6/0x1c0 fs/read_write.c:977
        [<ffffffff848802d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
        [<ffffffff848802d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
        [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    In nci_rx_data_packet(), if we don't get a valid conn_info, we will return
    directly but forget to release the skb.
    
    Reported-by: syzbot+cdb9a427d1bc08815104@syzkaller.appspotmail.com
    Fixes: 4aeee687 ("NFC: nci: Add dynamic logical connections support")
    Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
    Link: https://lore.kernel.org/r/20221118082419.239475-1-liushixin2@huawei.comSigned-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
    53270fb0
data.c 7 KB