提交 ca42fb9e 编写于 作者: D Dan Carpenter 提交者: Samuel Ortiz

NFC: nfcmrvl: double free on error path

The nci_spi_send() function calls kfree_skb(skb) on both error and
success so this extra kfree_skb() is a double free.

Fixes: caf6e49b ("NFC: nfcmrvl: add spi driver")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>
上级 52fdede5
...@@ -95,10 +95,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv, ...@@ -95,10 +95,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv,
/* Send the SPI packet */ /* Send the SPI packet */
err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion, err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion,
skb); skb);
if (err != 0) { if (err)
nfc_err(priv->dev, "spi_send failed %d", err); nfc_err(priv->dev, "spi_send failed %d", err);
kfree_skb(skb);
}
return err; return err;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册