lkml.org 
[lkml]   [2018]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.9 094/219] NFC: nfcmrvl: double free on error path
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit ca42fb9e52d155547e6cf18cf26bce3e1a6af4ea ]

    The nci_spi_send() function calls kfree_skb(skb) on both error and
    success so this extra kfree_skb() is a double free.

    Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    drivers/nfc/nfcmrvl/spi.c | 5 ++---
    1 file changed, 2 insertions(+), 3 deletions(-)

    diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c
    index a7faa0bcc01e..fc8e78a29d77 100644
    --- a/drivers/nfc/nfcmrvl/spi.c
    +++ b/drivers/nfc/nfcmrvl/spi.c
    @@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv,
    /* Send the SPI packet */
    err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion,
    skb);
    - if (err != 0) {
    + if (err)
    nfc_err(priv->dev, "spi_send failed %d", err);
    - kfree_skb(skb);
    - }
    +
    return err;
    }

    --
    2.14.1
    \
     
     \ /
      Last update: 2018-03-04 00:50    [W:5.232 / U:2.328 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site