Commit 81636dc6 authored by Krzysztof Kozlowski's avatar Krzysztof Kozlowski Committed by Ziyang Xuan
Browse files

nfc: llcp: simplify llcp_sock_connect() error paths 

stable inclusion
from stable-v5.10.188
commit a3a1550c4d2e5fecbd317778ef2832e933d4774b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7NLJR
CVE: CVE-2023-3863

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a3a1550c4d2e5fecbd317778ef2832e933d4774b



---------------------------

[ Upstream commit ec10fd15 ]

The llcp_sock_connect() error paths were using a mixed way of central
exit (goto) and cleanup

Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Stable-dep-of: 6709d4b7 ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
parent 87684ac5

net/nfc/llcp_sock.c

+4 −3
Original line number Diff line number Diff line
@@ -712,10 +712,8 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, 
	llcp_sock->local = nfc_llcp_local_get(local);

	llcp_sock->ssap = nfc_llcp_get_local_ssap(local);

	if (llcp_sock->ssap == LLCP_SAP_MAX) {

		nfc_llcp_local_put(llcp_sock->local);

		llcp_sock->local = NULL;

		ret = -ENOMEM;

		goto put_dev;

		goto sock_llcp_put_local;

	}



	llcp_sock->reserved_ssap = llcp_sock->ssap;
@@ -760,8 +758,11 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, 


sock_llcp_release:

	nfc_llcp_put_ssap(local, llcp_sock->ssap);



sock_llcp_put_local:

	nfc_llcp_local_put(llcp_sock->local);

	llcp_sock->local = NULL;

	llcp_sock->dev = NULL;



put_dev:

	nfc_put_device(dev);