summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorChristophe Ricard <christophe.ricard@gmail.com>2015-08-14 20:33:34 (GMT)
committerSamuel Ortiz <sameo@linux.intel.com>2015-08-16 22:35:07 (GMT)
commitdaaf1e1f1640eb11259954d1d847d8a72ab5b938 (patch)
tree3811de46d9617e3a7725bc4747132a98742fdaf2 /drivers
parent5a3570061a131309143a49e4bbdbce7e23f261e7 (diff)
downloadlinux-daaf1e1f1640eb11259954d1d847d8a72ab5b938.tar.xz
NFC: st-nci: fix use of uninitialized variables in error path
st_nci_hci_load_session() calls kfree_skb() on unitialized variables skb_pipe_info and skb_pipe_list if the call to nci_hci_connect_gate() failed. Reword the error path to not use these variables when they are not initialized. While at it, there seemed to be a memory leak because skb_pipe_info was only freed once, after the for-loop, even though several ones were created by nci_hci_send_cmd. Cc: stable@vger.kernel.org Acked-by: Christophe Ricard <christophe-h.ricard@st.com> Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/nfc/st-nci/st-nci_se.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/nfc/st-nci/st-nci_se.c b/drivers/nfc/st-nci/st-nci_se.c
index 97addfa..c742ef6 100644
--- a/drivers/nfc/st-nci/st-nci_se.c
+++ b/drivers/nfc/st-nci/st-nci_se.c
@@ -189,14 +189,14 @@ int st_nci_hci_load_session(struct nci_dev *ndev)
ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DEVICE_MGNT_PIPE);
if (r < 0)
- goto free_info;
+ return r;
/* Get pipe list */
r = nci_hci_send_cmd(ndev, ST_NCI_DEVICE_MGNT_GATE,
ST_NCI_DM_GETINFO, pipe_list, sizeof(pipe_list),
&skb_pipe_list);
if (r < 0)
- goto free_info;
+ return r;
/* Complete the existing gate_pipe table */
for (i = 0; i < skb_pipe_list->len; i++) {
@@ -222,6 +222,7 @@ int st_nci_hci_load_session(struct nci_dev *ndev)
dm_pipe_info->src_host_id != ST_NCI_ESE_HOST_ID) {
pr_err("Unexpected apdu_reader pipe on host %x\n",
dm_pipe_info->src_host_id);
+ kfree_skb(skb_pipe_info);
continue;
}
@@ -241,13 +242,12 @@ int st_nci_hci_load_session(struct nci_dev *ndev)
ndev->hci_dev->pipes[st_nci_gates[j].pipe].host =
dm_pipe_info->src_host_id;
}
+ kfree_skb(skb_pipe_info);
}
memcpy(ndev->hci_dev->init_data.gates, st_nci_gates,
sizeof(st_nci_gates));
-free_info:
- kfree_skb(skb_pipe_info);
kfree_skb(skb_pipe_list);
return r;
}