NFC: st21nfcb: double free on allocation error

PATCH Christophe RICARD 1 participant 1 message Aug 9, 2014 Kernel janitors

Share & tools

Christophe RICARD

author

2014-08-09 21:49 UTC #0 lore raw

Hi Dan,

A patch fixing this issue got already sent to the linux-nfc mailing list.
Here is a pointer to the patch:
https://lists.01.org/pipermail/linux-nfc/2014-July/002647.html

You are welcome to comment if anything is wrong.

Best Regards
Christophe

Quoted 28 lines · On Thu, 31 Jul 2014 12:41:23 +0300 Dan Carpenter <[email protected]>…

"info" is allocated with devm_kzalloc() so calling kfree() here will lead to a double free.
Signed-off-by Dan Carpenter <[email protected]>
(quoted diff) +0 -0
b/drivers/nfc/st21nfcb/st21nfcb.c index 4d95863..6944f9e 100644
drivers/nfc/st21nfcb/st21nfcb.c +1 -2
@@ -94,8 +94,7 @@ int st21nfcb_nci_probe(struct llt_ndlc *ndlc, int
 phy_headroom, phy_headroom, phy_tailroom);
 	if (!ndlc->ndev) {
 		pr_err("Cannot allocate nfc ndev\n");
-		r = -ENOMEM;
-		goto err_alloc_ndev;
+		return -ENOMEM;
 	}
 	info->ndlc = ndlc;
 
@@ -109,8 +108,6 @@ int st21nfcb_nci_probe(struct llt_ndlc *ndlc, int
phy_headroom, err_regdev:
drivers/nfc/st21nfcb/st21nfcb.c +0 -2
 	nci_free_device(ndlc->ndev);
 
-err_alloc_ndev:
-	kfree(info);
 	return r;
 }
 EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);