From patchwork Fri Jun 29 12:47:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Mack X-Patchwork-Id: 10496547 X-Patchwork-Delegate: sameo@linux.intel.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E611260230 for ; Fri, 29 Jun 2018 12:47:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D2C0929715 for ; Fri, 29 Jun 2018 12:47:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C6C9329717; Fri, 29 Jun 2018 12:47:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8199829715 for ; Fri, 29 Jun 2018 12:47:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935122AbeF2Mr0 (ORCPT ); Fri, 29 Jun 2018 08:47:26 -0400 Received: from mail.bugwerft.de ([46.23.86.59]:33800 "EHLO mail.bugwerft.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935084AbeF2MrY (ORCPT ); Fri, 29 Jun 2018 08:47:24 -0400 Received: from localhost.localdomain (200116b8464c0500c0a26f38d9c6fb41.dip.versatel-1u1.de [IPv6:2001:16b8:464c:500:c0a2:6f38:d9c6:fb41]) by mail.bugwerft.de (Postfix) with ESMTPSA id CFB0F28C34C; Fri, 29 Jun 2018 12:44:08 +0000 (UTC) From: Daniel Mack To: sameo@linux.intel.com, davem@davemloft.net Cc: linux-wireless@vger.kernel.org, Daniel Mack Subject: [PATCH 2/2] nfc: st95hf: drop another illegal kfree_skb() Date: Fri, 29 Jun 2018 14:47:17 +0200 Message-Id: <20180629124717.2011-2-daniel@zonque.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180629124717.2011-1-daniel@zonque.org> References: <20180629124717.2011-1-daniel@zonque.org> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In the error path of the IRQ handler, don't free the skb in flight. The callback in the digital core will do that for us, so this is another double-free that leads to memory corruptions. The assignment of 'wtx' doesn't make sense as the variable is not read after it is written. Drop it. Signed-off-by: Daniel Mack --- drivers/nfc/st95hf/core.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c index ef91ca8b53a4..e651e1aae5a3 100644 --- a/drivers/nfc/st95hf/core.c +++ b/drivers/nfc/st95hf/core.c @@ -868,8 +868,6 @@ static irqreturn_t st95hf_irq_thread_handler(int irq, void *st95hfcontext) return IRQ_HANDLED; end: - kfree_skb(skb_resp); - wtx = false; cb_arg->rats = false; skb_resp = ERR_PTR(result); /* call of callback with error */