提交 b7769344 编写于 作者: T Thierry Escande 提交者: Samuel Ortiz

NFC: digital: Fix a memory leak in NFC-F listening mode

When configured as a target listening for a SENSF_REQ poll command, a
nfcid2 array was allocated for no reason leading to a memory leak. The
nfcid2 is sent by the target in the SENSF_RES reply.
Signed-off-by: NThierry Escande <thierry.escande@collabora.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
上级 8f49bec6
...@@ -1257,21 +1257,12 @@ static int digital_tg_config_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech) ...@@ -1257,21 +1257,12 @@ static int digital_tg_config_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech)
int digital_tg_listen_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech) int digital_tg_listen_nfcf(struct nfc_digital_dev *ddev, u8 rf_tech)
{ {
int rc; int rc;
u8 *nfcid2;
rc = digital_tg_config_nfcf(ddev, rf_tech); rc = digital_tg_config_nfcf(ddev, rf_tech);
if (rc) if (rc)
return rc; return rc;
nfcid2 = kzalloc(NFC_NFCID2_MAXSIZE, GFP_KERNEL); return digital_tg_listen(ddev, 300, digital_tg_recv_sensf_req, NULL);
if (!nfcid2)
return -ENOMEM;
nfcid2[0] = DIGITAL_SENSF_NFCID2_NFC_DEP_B1;
nfcid2[1] = DIGITAL_SENSF_NFCID2_NFC_DEP_B2;
get_random_bytes(nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2);
return digital_tg_listen(ddev, 300, digital_tg_recv_sensf_req, nfcid2);
} }
void digital_tg_recv_md_req(struct nfc_digital_dev *ddev, void *arg, void digital_tg_recv_md_req(struct nfc_digital_dev *ddev, void *arg,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册