mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
NFC: st21nfca: fix double free
[ Upstream commit 99a8efbb6e
]
The variable nfcid_skb is not changed in the callee nfc_hci_get_param()
if error occurs. Consequently, the freed variable nfcid_skb will be
freed again, resulting in a double free bug. Set nfcid_skb to NULL after
releasing it to fix the bug.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
1143496c96
commit
956b388535
1 changed files with 1 additions and 0 deletions
|
@ -719,6 +719,7 @@ static int st21nfca_hci_complete_target_discovered(struct nfc_hci_dev *hdev,
|
|||
NFC_PROTO_FELICA_MASK;
|
||||
} else {
|
||||
kfree_skb(nfcid_skb);
|
||||
nfcid_skb = NULL;
|
||||
/* P2P in type A */
|
||||
r = nfc_hci_get_param(hdev, ST21NFCA_RF_READER_F_GATE,
|
||||
ST21NFCA_RF_READER_F_NFCID1,
|
||||
|
|
Loading…
Reference in a new issue