From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
nfcmrvl_usb_nci_send() gets an skb from the NCI core and sends it
over USB. If the URB allocation or submission fails, the skb is
left allocated and leaks.
Free the skb when URB allocation or submission fails.
Fixes: f26e30cc6b50 ("NFC: nfcmrvl: Initial commit for Marvell NFC driver")
Reported-by: syzbot+b197a0fb4e741cc5030e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b197a0fb4e741cc5030e
Tested-by: syzbot+b197a0fb4e741cc5030e@syzkaller.appspotmail.com
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
---
drivers/nfc/nfcmrvl/usb.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
index c7f2afe00b93..7a4094797ba4 100644
--- a/drivers/nfc/nfcmrvl/usb.c
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -224,12 +224,16 @@ static int nfcmrvl_usb_nci_send(struct nfcmrvl_private *priv,
unsigned int pipe;
int err;
- if (!drv_data->bulk_tx_ep)
+ if (!drv_data->bulk_tx_ep) {
+ kfree_skb(skb);
return -ENODEV;
+ }
urb = usb_alloc_urb(0, GFP_ATOMIC);
- if (!urb)
+ if (!urb) {
+ kfree_skb(skb);
return -ENOMEM;
+ }
pipe = usb_sndbulkpipe(drv_data->udev,
drv_data->bulk_tx_ep->bEndpointAddress);
@@ -254,6 +258,7 @@ static int nfcmrvl_usb_nci_send(struct nfcmrvl_private *priv,
"urb %p submission failed (%d)\n", urb, -err);
kfree(urb->setup_packet);
usb_unanchor_urb(urb);
+ kfree_skb(skb);
} else {
usb_mark_last_busy(drv_data->udev);
}
--
2.43.0