diff options
| author | Johan Hovold <johan@kernel.org> | 2019-10-07 18:40:59 +0200 |
|---|---|---|
| committer | Jakub Kicinski <jakub.kicinski@netronome.com> | 2019-10-08 16:52:26 -0700 |
| commit | 6af3aa57a0984e061f61308fe181a9a12359fecc (patch) | |
| tree | 9146b10e8f88624f36c9876c64f16b9e723f6a63 /drivers/nfc | |
| parent | 4b793feccae3b06764268377a4030eb774ed924e (diff) | |
| download | linux-6af3aa57a0984e061f61308fe181a9a12359fecc.tar.gz linux-6af3aa57a0984e061f61308fe181a9a12359fecc.tar.bz2 linux-6af3aa57a0984e061f61308fe181a9a12359fecc.zip | |
NFC: pn533: fix use-after-free and memleaks
The driver would fail to deregister and its class device and free
related resources on late probe errors.
Reported-by: syzbot+cb035c75c03dbe34b796@syzkaller.appspotmail.com
Fixes: 32ecc75ded72 ("NFC: pn533: change order operations in dev registation")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Diffstat (limited to 'drivers/nfc')
| -rw-r--r-- | drivers/nfc/pn533/usb.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c index c5289eaf17ee..e897e4d768ef 100644 --- a/drivers/nfc/pn533/usb.c +++ b/drivers/nfc/pn533/usb.c @@ -547,18 +547,25 @@ static int pn533_usb_probe(struct usb_interface *interface, rc = pn533_finalize_setup(priv); if (rc) - goto error; + goto err_deregister; usb_set_intfdata(interface, phy); return 0; +err_deregister: + pn533_unregister_device(phy->priv); error: + usb_kill_urb(phy->in_urb); + usb_kill_urb(phy->out_urb); + usb_kill_urb(phy->ack_urb); + usb_free_urb(phy->in_urb); usb_free_urb(phy->out_urb); usb_free_urb(phy->ack_urb); usb_put_dev(phy->udev); kfree(in_buf); + kfree(phy->ack_buffer); return rc; } |