[PATCH net 2/2] nfc: st21nfca: Free the ATR_REQ skb after sending it

[Suyuan Wang via B4 Relay <devnull+shyckless.gmail.com@kernel.org>]

From: Suyuan Wang <stevewong@hust.edu.cn>

st21nfca_im_send_atr_req() allocates an skb for the ATR_REQ, passes
its data to the HCI layer and then forgets about it:

    return nfc_hci_send_cmd_async(hdev, ST21NFCA_RF_READER_F_GATE,
                            ST21NFCA_WR_XCHG_DATA, skb->data,
                            skb->len, info->async_cb, info);

nfc_hci_send_cmd_async() copies the payload into its own fragments, so
the skb is still ours to free. As it is, one skb leaks on every ATR_REQ
sent in initiator mode, whether or not the command was queued.

Free it right after the call, on success and on error, as
st21nfca_tx_work() does for the same call.

Found with a static analysis tool and checked by hand.

Fixes: 1892bf844ea0 ("NFC: st21nfca: Adding P2P support to st21nfca in Initiator & Target mode")
Cc: stable@vger.kernel.org
Co-developed-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Kaixuan Li <kaixuan.li@ntu.edu.sg>
Signed-off-by: Suyuan Wang <stevewong@hust.edu.cn>
---
Compile tested only, I don't have ST21NFCA hardware.
---
 drivers/nfc/st21nfca/dep.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/nfc/st21nfca/dep.c b/drivers/nfc/st21nfca/dep.c
index a5fab4fd5129..4b9054eb0208 100644
--- a/drivers/nfc/st21nfca/dep.c
+++ b/drivers/nfc/st21nfca/dep.c
@@ -496,6 +496,7 @@ int st21nfca_im_send_atr_req(struct nfc_hci_dev *hdev, u8 *gb, size_t gb_len)
 	struct st21nfca_atr_req *atr_req;
 	struct nfc_target *target;
 	uint size;
+	int r;
 
 	info->dep_info.to = ST21NFCA_DEFAULT_TIMEOUT;
 	size = ST21NFCA_ATR_REQ_MIN_SIZE + gb_len;
@@ -547,9 +548,11 @@ int st21nfca_im_send_atr_req(struct nfc_hci_dev *hdev, u8 *gb, size_t gb_len)
 	info->dep_info.bsi = atr_req->bsi;
 	info->dep_info.lri = ST21NFCA_PP2LRI(atr_req->ppi);
 
-	return nfc_hci_send_cmd_async(hdev, ST21NFCA_RF_READER_F_GATE,
-				ST21NFCA_WR_XCHG_DATA, skb->data,
-				skb->len, info->async_cb, info);
+	r = nfc_hci_send_cmd_async(hdev, ST21NFCA_RF_READER_F_GATE,
+				   ST21NFCA_WR_XCHG_DATA, skb->data,
+				   skb->len, info->async_cb, info);
+	kfree_skb(skb);
+	return r;
 }
 EXPORT_SYMBOL(st21nfca_im_send_atr_req);
 

-- 
2.34.1