[PATCH net-next] NFC: digital: fix target leak after Type 1 Tag discovery

[PATCH net-next] NFC: digital: fix target leak after Type 1 Tag discovery

[Xia Yan]

digital_in_recv_sens_res() allocates a target for an NFC-A response.
For a Type 1 Tag, it calls digital_target_found() synchronously.
nfc_targets_found() copies the target into dev->targets.

On success, rc is zero and the callback skips kfree(target).
The original allocation is lost when the callback returns.
Each completed Type 1 Tag discovery leaks one struct nfc_target.

Free the target after digital_target_found() returns. Clear the pointer
to avoid freeing it again on the error path. Keep the target for other
tag types, whose discovery continues asynchronously.

Found during a code review of NFC-A target ownership.

Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support")
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
---
 net/nfc/digital_technology.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index ae6487c10a25..2d52e390cc67 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -510,10 +510,13 @@ static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg,
 		goto exit;
 	}
 
-	if (DIGITAL_SENS_RES_IS_T1T(target->sens_res))
+	if (DIGITAL_SENS_RES_IS_T1T(target->sens_res)) {
 		rc = digital_target_found(ddev, target, NFC_PROTO_JEWEL);
-	else
+		kfree(target);
+		target = NULL;
+	} else {
 		rc = digital_in_send_sdd_req(ddev, target);
+	}
 
 exit:
 	dev_kfree_skb(resp);

Re: [PATCH net-next] NFC: digital: fix target leak after Type 1 Tag discovery

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.