NFC: nfcmrvl: double free on error path

PATCH Applied Dan Carpenter 2 participants 5 messages Mar 8, 2017 – Apr 19, 2017

Subsystems (2)

Kernel janitors NFC

lore

Share & tools

lore

Dan Carpenter

author

2017-03-08 05:22 UTC #0 lore raw

PATCH 1/1 NFC: nfcmrvl: double free on error path

The nci_spi_send() function calls kfree_skb(skb) on both error and success so this extra kfree_skb() is a double free.

Fixes caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")

Signed-off-by Dan Carpenter <[email protected]>

---
Static analysis. Not tested.

drivers/nfc/nfcmrvl/spi.c +2 -3

index a7faa0bcc01e..fc8e78a29d77 100644
@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv,
 	/* Send the SPI packet */
 	err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion,
 			   skb);
-	if (err != 0) {
+	if (err)
 		nfc_err(priv->dev, "spi_send failed %d", err);
-		kfree_skb(skb);
-	}
+
 	return err;
 }

Samuel Ortiz

Applied

2017-04-01 22:11 UTC #1 lore raw

Hi Dan,

Quoted 7 lines · Dan Carpenter

The nci_spi_send() function calls kfree_skb(skb) on both error and success so this extra kfree_skb() is a double free.
Fixes caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by Dan Carpenter <[email protected]>
---
Static analysis. Not tested.

Applied to nfc-next, thanks.

Cheers,
Samuel.

Dan Carpenter

author

2017-04-19 11:47 UTC #2 lore raw

Quoted 12 lines · Samuel Ortiz

Hi Dan,
Quoted 7 lines · Dan Carpenter
The nci_spi_send() function calls kfree_skb(skb) on both error and success so this extra kfree_skb() is a double free.
Fixes caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by Dan Carpenter <[email protected]>
---
Static analysis. Not tested.
Applied to nfc-next, thanks.

This is still not showing up in linux-next.

regards,
dan carpenter

Samuel Ortiz

2017-04-19 12:52 UTC #3 lore raw

Quoted 7 lines · Dan Carpenter

Quoted 6 lines · Samuel Ortiz
Hi Dan,
Quoted 3 lines · Dan Carpenter
The nci_spi_send() function calls kfree_skb(skb) on both error and success so this extra kfree_skb() is a double free.

Quoted 8 lines

Quoted 6 lines
Quoted 4 lines
Fixes caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by Dan Carpenter <[email protected]>
---
Static analysis. Not tested.
Applied to nfc-next, thanks.
This is still not showing up in linux-next.

I sent a pending pull request containing it.

Cheers,
Samuel

Dan Carpenter

author

2017-04-19 13:29 UTC #4 lore raw

Quoted 12 lines · Samuel Ortiz

Quoted 11 lines · Dan Carpenter
Quoted 10 lines · Samuel Ortiz
Hi Dan,
Quoted 7 lines · Dan Carpenter
The nci_spi_send() function calls kfree_skb(skb) on both error and success so this extra kfree_skb() is a double free.
Fixes caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by Dan Carpenter <[email protected]>
---
Static analysis. Not tested.

Quoted 5 lines

Quoted 4 lines
Quoted 2 lines
Applied to nfc-next, thanks.
This is still not showing up in linux-next.
I sent a pending pull request containing it.

Ah. Sorry for the noise. I didn't realize your tree didn't feed into linux-next directly. Perhaps it should, though?

regards,
dan carpenter