Re: [syzbot] [usb?] [nfc?] [net?] memory leak in nci_send_cmd

[Yalagada Pavan Kumar]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73ae59e975966d24e32926247ddb45a537ebe184

diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
index c7f2afe00b93..7a4094797ba4 100644
--- a/drivers/nfc/nfcmrvl/usb.c
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -224,12 +224,16 @@ static int nfcmrvl_usb_nci_send(struct nfcmrvl_private *priv,
        unsigned int pipe;
        int err;
 
-       if (!drv_data->bulk_tx_ep)
+       if (!drv_data->bulk_tx_ep) {
+               kfree_skb(skb);
                return -ENODEV;
+       }
 
        urb = usb_alloc_urb(0, GFP_ATOMIC);
-       if (!urb)
+       if (!urb) {
+               kfree_skb(skb);
                return -ENOMEM;
+       }
 
        pipe = usb_sndbulkpipe(drv_data->udev,
                                drv_data->bulk_tx_ep->bEndpointAddress);
@@ -254,6 +258,7 @@ static int nfcmrvl_usb_nci_send(struct nfcmrvl_private *priv,
                                "urb %p submission failed (%d)\n", urb, -err);
                kfree(urb->setup_packet);
                usb_unanchor_urb(urb);
+               kfree_skb(skb);
        } else {
                usb_mark_last_busy(drv_data->udev);
        }