]> git.ipfire.org Git - thirdparty/linux.git/commit
nfc: s3fwrn5: allocate rx skb before consuming bytes
authorPengpeng Hou <pengpeng@iscas.ac.cn>
Thu, 2 Apr 2026 04:21:48 +0000 (12:21 +0800)
committerJakub Kicinski <kuba@kernel.org>
Fri, 3 Apr 2026 22:57:46 +0000 (15:57 -0700)
commit5c14a19d5b1645cce1cb1252833d70b23635b632
tree16f06b64966b82ac404ad40be9320f7ccc3df08b
parent77facb35227c421467cdb49268de433168c2dcef
nfc: s3fwrn5: allocate rx skb before consuming bytes

s3fwrn82_uart_read() reports the number of accepted bytes to the serdev
core. The current code consumes bytes into recv_skb and may already
deliver a complete frame before allocating a fresh receive buffer.

If that alloc_skb() fails, the callback returns 0 even though it has
already consumed bytes, and it leaves recv_skb as NULL for the next
receive callback. That breaks the receive_buf() accounting contract and
can also lead to a NULL dereference on the next skb_put_u8().

Allocate the receive skb lazily before consuming the next byte instead.
If allocation fails, return the number of bytes already accepted.

Fixes: 3f52c2cb7e3a ("nfc: s3fwrn5: Support a UART interface")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260402042148.65236-1-pengpeng@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/nfc/s3fwrn5/uart.c