All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniel Mack <daniel@zonque.org>
To: sameo@linux.intel.com, davem@davemloft.net
Cc: linux-wireless@vger.kernel.org, Daniel Mack <daniel@zonque.org>
Subject: [PATCH 2/2] nfc: st95hf: drop another illegal kfree_skb()
Date: Fri, 29 Jun 2018 14:47:17 +0200	[thread overview]
Message-ID: <20180629124717.2011-2-daniel@zonque.org> (raw)
In-Reply-To: <20180629124717.2011-1-daniel@zonque.org>

In the error path of the IRQ handler, don't free the skb in flight. The
callback in the digital core will do that for us, so this is another
double-free that leads to memory corruptions.

The assignment of 'wtx' doesn't make sense as the variable is not read
after it is written. Drop it.

Signed-off-by: Daniel Mack <daniel@zonque.org>
---
 drivers/nfc/st95hf/core.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
index ef91ca8b53a4..e651e1aae5a3 100644
--- a/drivers/nfc/st95hf/core.c
+++ b/drivers/nfc/st95hf/core.c
@@ -868,8 +868,6 @@ static irqreturn_t st95hf_irq_thread_handler(int irq, void  *st95hfcontext)
 	return IRQ_HANDLED;
 
 end:
-	kfree_skb(skb_resp);
-	wtx = false;
 	cb_arg->rats = false;
 	skb_resp = ERR_PTR(result);
 	/* call of callback with error */
-- 
2.17.1

  reply	other threads:[~2018-06-29 12:47 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-29 12:47 [PATCH 1/2] nfc: st95hf: drop nfcdev_free Daniel Mack
2018-06-29 12:47 ` Daniel Mack [this message]
2018-07-17 13:49   ` [PATCH 2/2] nfc: st95hf: drop another illegal kfree_skb() Daniel Mack

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180629124717.2011-2-daniel@zonque.org \
    --to=daniel@zonque.org \
    --cc=davem@davemloft.net \
    --cc=linux-wireless@vger.kernel.org \
    --cc=sameo@linux.intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.