From patchwork Mon Jul 23 14:00:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Mack X-Patchwork-Id: 10540353 X-Patchwork-Delegate: sameo@linux.intel.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BC2761823 for ; Mon, 23 Jul 2018 14:00:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AD12928AF3 for ; Mon, 23 Jul 2018 14:00:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A924828AF7; Mon, 23 Jul 2018 14:00:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 533F328AFB for ; Mon, 23 Jul 2018 14:00:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388098AbeGWPBy (ORCPT ); Mon, 23 Jul 2018 11:01:54 -0400 Received: from mail.bugwerft.de ([46.23.86.59]:49872 "EHLO mail.bugwerft.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388071AbeGWPBy (ORCPT ); Mon, 23 Jul 2018 11:01:54 -0400 Received: from localhost.localdomain (i577BC19A.versanet.de [87.123.193.154]) by mail.bugwerft.de (Postfix) with ESMTPSA id B9A442916AC; Mon, 23 Jul 2018 14:00:06 +0000 (UTC) From: Daniel Mack To: sameo@linux.intel.com Cc: linux-wireless@vger.kernel.org, colin.king@canonical.com, shikha.singh@st.com, Daniel Mack Subject: [PATCH 01/10] Revert "NFC: st95hf: drop illegal kfree_skb()" Date: Mon, 23 Jul 2018 16:00:06 +0200 Message-Id: <20180723140015.11663-2-daniel@zonque.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180723140015.11663-1-daniel@zonque.org> References: <20180723140015.11663-1-daniel@zonque.org> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This reverts commit c99f996b2ba49 ("NFC: st95hf: drop illegal kfree_skb()"). It turns out that the st95hf_in_send_cmd() is in fact the sole owner of this skb, and by not freeing it here, we not only causing a memory leak but also mess up the refcount of the socket that holds it. This will in turn lead to activated targets not being cleaned up, even after stopping userspace processes. The memory corruption that I was hunting was caused by another kfree_skb(). This will be fixed in a later commit. Signed-off-by: Daniel Mack Fixes: c99f996b2ba49 ("NFC: st95hf: drop illegal kfree_skb()") --- drivers/nfc/st95hf/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c index 36ef0e905ba3..bc1a2070f9bb 100644 --- a/drivers/nfc/st95hf/core.c +++ b/drivers/nfc/st95hf/core.c @@ -991,6 +991,8 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev, goto free_skb_resp; } + kfree_skb(skb); + return rc; free_skb_resp: