nfc: digital: free skb on digital_in_send error paths

digital_in_send() takes ownership of the skb passed by the caller
(nfc_data_exchange), make sure it's freed on all error paths.

Found looking around the real driver for similar bugs to the one
just fixed in nci.

Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support")
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260303162346.2071888-3-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index 3670bb33732e4830cf55479286a540582b2801b5..7cb1e6aaae90da24d3b2d298f4d1d3d04ce73e04 100644 (file)
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -707,8 +707,10 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
        int rc;
 
        data_exch = kzalloc_obj(*data_exch);
-       if (!data_exch)
+       if (!data_exch) {
+               kfree_skb(skb);
                return -ENOMEM;
+       }
 
        data_exch->cb = cb;
        data_exch->cb_context = cb_context;
@@ -731,8 +733,10 @@ static int digital_in_send(struct nfc_dev *nfc_dev, struct nfc_target *target,
                                 data_exch);
 
 exit:
-       if (rc)
+       if (rc) {
+               kfree_skb(skb);
                kfree(data_exch);
+       }
 
        return rc;
 }