nfc: fix potential illegal memory access

albinyang · gregkh · commit 7c8f2c52a721 · 2019-08-04T09:34:54.000+02:00
[ Upstream commit dd006fc ] The frags_q is not properly initialized, it may result in illegal memory access when conn_info is NULL. The "goto free_exit" should be replaced by "goto exit". Signed-off-by: Yang Wei <albin_yang@163.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
@@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,
 	conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id);
 	if (!conn_info) {
 		rc = -EPROTO;
-		goto free_exit;
+		goto exit;
 	}
 
 	__skb_queue_head_init(&frags_q);

Original file line number	Diff line number	Diff line change
`@@ -119,7 +119,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev,`
`119`	`119`	`conn_info = nci_get_conn_info_by_conn_id(ndev, conn_id);`
`120`	`120`	`if (!conn_info) {`
`121`	`121`	`rc = -EPROTO;`
`122`		`- goto free_exit;`
	`122`	`+ goto exit;`
`123`	`123`	`}`
`124`	`124`
`125`	`125`	`__skb_queue_head_init(&frags_q);`