Commit aa5a5b7a authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'nfc-fixes' 

Xiaoming Ni says:

====================
nfc: fix Resource leakage and endless loop

fix Resource leakage and endless loop in net/nfc/llcp_sock.c,
 reported by "kiyin(尹亮)".

Link: https://www.openwall.com/lists/oss-security/2020/11/01/1


====================
math: Export mul_u64_u64_div_u64

Fixes: f51d7bf1 ("ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation")
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents d7513508 4b5db93e

net/nfc/llcp_sock.c

+10 −0
Original line number Diff line number Diff line
@@ -108,11 +108,13 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) 
					  llcp_sock->service_name_len,

					  GFP_KERNEL);

	if (!llcp_sock->service_name) {

		nfc_llcp_local_put(llcp_sock->local);

		ret = -ENOMEM;

		goto put_dev;

	}

	llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);

	if (llcp_sock->ssap == LLCP_SAP_MAX) {

		nfc_llcp_local_put(llcp_sock->local);

		kfree(llcp_sock->service_name);

		llcp_sock->service_name = NULL;

		ret = -EADDRINUSE;
@@ -671,6 +673,10 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, 
		ret = -EISCONN;

		goto error;

	}

	if (sk->sk_state == LLCP_CONNECTING) {

		ret = -EINPROGRESS;

		goto error;

	}



	dev = nfc_get_device(addr->dev_idx);

	if (dev == NULL) {
@@ -702,6 +708,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, 
	llcp_sock->local = nfc_llcp_local_get(local);

	llcp_sock->ssap = nfc_llcp_get_local_ssap(local);

	if (llcp_sock->ssap == LLCP_SAP_MAX) {

		nfc_llcp_local_put(llcp_sock->local);

		ret = -ENOMEM;

		goto put_dev;

	}
@@ -743,9 +750,12 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, 


sock_unlink:

	nfc_llcp_sock_unlink(&local->connecting_sockets, sk);

	kfree(llcp_sock->service_name);

	llcp_sock->service_name = NULL;



sock_llcp_release:

	nfc_llcp_put_ssap(local, llcp_sock->ssap);

	nfc_llcp_local_put(llcp_sock->local);



put_dev:

	nfc_put_device(dev);