* [PATCH] NFC: nfcmrvl: double free on error path
@ 2017-03-08 5:22 Dan Carpenter
2017-04-01 22:11 ` Samuel Ortiz
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2017-03-08 5:22 UTC (permalink / raw)
To: Lauro Ramos Venancio, Vincent Cuissard
Cc: Aloisio Almeida Jr, Samuel Ortiz, linux-wireless, kernel-janitors
The nci_spi_send() function calls kfree_skb(skb) on both error and
success so this extra kfree_skb() is a double free.
Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Static analysis. Not tested.
diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c
index a7faa0bcc01e..fc8e78a29d77 100644
--- a/drivers/nfc/nfcmrvl/spi.c
+++ b/drivers/nfc/nfcmrvl/spi.c
@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv,
/* Send the SPI packet */
err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion,
skb);
- if (err != 0) {
+ if (err)
nfc_err(priv->dev, "spi_send failed %d", err);
- kfree_skb(skb);
- }
+
return err;
}
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] NFC: nfcmrvl: double free on error path
2017-03-08 5:22 [PATCH] NFC: nfcmrvl: double free on error path Dan Carpenter
@ 2017-04-01 22:11 ` Samuel Ortiz
2017-04-19 11:47 ` Dan Carpenter
0 siblings, 1 reply; 5+ messages in thread
From: Samuel Ortiz @ 2017-04-01 22:11 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Vincent Cuissard, linux-wireless, kernel-janitors
Hi Dan,
On Wed, Mar 08, 2017 at 08:22:37AM +0300, Dan Carpenter wrote:
> The nci_spi_send() function calls kfree_skb(skb) on both error and
> success so this extra kfree_skb() is a double free.
>
> Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Static analysis. Not tested.
Applied to nfc-next, thanks.
Cheers,
Samuel.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] NFC: nfcmrvl: double free on error path
2017-04-01 22:11 ` Samuel Ortiz
@ 2017-04-19 11:47 ` Dan Carpenter
2017-04-19 12:52 ` Samuel Ortiz
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2017-04-19 11:47 UTC (permalink / raw)
To: Samuel Ortiz; +Cc: Vincent Cuissard, linux-wireless, kernel-janitors
On Sun, Apr 02, 2017 at 12:11:17AM +0200, Samuel Ortiz wrote:
> Hi Dan,
>
> On Wed, Mar 08, 2017 at 08:22:37AM +0300, Dan Carpenter wrote:
> > The nci_spi_send() function calls kfree_skb(skb) on both error and
> > success so this extra kfree_skb() is a double free.
> >
> > Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> > Static analysis. Not tested.
> Applied to nfc-next, thanks.
>
This is still not showing up in linux-next.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] NFC: nfcmrvl: double free on error path
2017-04-19 11:47 ` Dan Carpenter
@ 2017-04-19 12:52 ` Samuel Ortiz
2017-04-19 13:29 ` Dan Carpenter
0 siblings, 1 reply; 5+ messages in thread
From: Samuel Ortiz @ 2017-04-19 12:52 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Vincent Cuissard, linux-wireless, kernel-janitors
On Wed, Apr 19, 2017 at 02:47:34PM +0300, Dan Carpenter wrote:
> On Sun, Apr 02, 2017 at 12:11:17AM +0200, Samuel Ortiz wrote:
> > Hi Dan,
> >
> > On Wed, Mar 08, 2017 at 08:22:37AM +0300, Dan Carpenter wrote:
> > > The nci_spi_send() function calls kfree_skb(skb) on both error and
> > > success so this extra kfree_skb() is a double free.
> > >
> > > Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
> > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > > ---
> > > Static analysis. Not tested.
> > Applied to nfc-next, thanks.
> >
>
> This is still not showing up in linux-next.
I sent a pending pull request containing it.
Cheers,
Samuel
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] NFC: nfcmrvl: double free on error path
2017-04-19 12:52 ` Samuel Ortiz
@ 2017-04-19 13:29 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2017-04-19 13:29 UTC (permalink / raw)
To: Samuel Ortiz; +Cc: Vincent Cuissard, linux-wireless, kernel-janitors
On Wed, Apr 19, 2017 at 02:52:29PM +0200, Samuel Ortiz wrote:
> On Wed, Apr 19, 2017 at 02:47:34PM +0300, Dan Carpenter wrote:
> > On Sun, Apr 02, 2017 at 12:11:17AM +0200, Samuel Ortiz wrote:
> > > Hi Dan,
> > >
> > > On Wed, Mar 08, 2017 at 08:22:37AM +0300, Dan Carpenter wrote:
> > > > The nci_spi_send() function calls kfree_skb(skb) on both error and
> > > > success so this extra kfree_skb() is a double free.
> > > >
> > > > Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
> > > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > > > ---
> > > > Static analysis. Not tested.
> > > Applied to nfc-next, thanks.
> > >
> >
> > This is still not showing up in linux-next.
> I sent a pending pull request containing it.
Ah. Sorry for the noise. I didn't realize your tree didn't feed into
linux-next directly. Perhaps it should, though?
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-04-19 13:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-08 5:22 [PATCH] NFC: nfcmrvl: double free on error path Dan Carpenter
2017-04-01 22:11 ` Samuel Ortiz
2017-04-19 11:47 ` Dan Carpenter
2017-04-19 12:52 ` Samuel Ortiz
2017-04-19 13:29 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).