From patchwork Tue Jul 24 08:54:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Mack X-Patchwork-Id: 10541703 X-Patchwork-Delegate: sameo@linux.intel.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A04C614BC for ; Tue, 24 Jul 2018 08:54:45 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 908C22864E for ; Tue, 24 Jul 2018 08:54:45 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 845B6286FE; Tue, 24 Jul 2018 08:54:45 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D33CD2864E for ; Tue, 24 Jul 2018 08:54:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388289AbeGXKAH (ORCPT ); Tue, 24 Jul 2018 06:00:07 -0400 Received: from mail.bugwerft.de ([46.23.86.59]:56646 "EHLO mail.bugwerft.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388280AbeGXKAH (ORCPT ); Tue, 24 Jul 2018 06:00:07 -0400 Received: from localhost.localdomain (i577BC1D8.versanet.de [87.123.193.216]) by mail.bugwerft.de (Postfix) with ESMTPSA id 3D8022919C3; Tue, 24 Jul 2018 08:54:18 +0000 (UTC) From: Daniel Mack To: sameo@linux.intel.com Cc: linux-wireless@vger.kernel.org, colin.king@canonical.com, shikha.singh@st.com, Daniel Mack Subject: [PATCH v2 03/10] NFC: st95hf: drop illegal kfree_skb() in IRQ handler Date: Tue, 24 Jul 2018 10:54:19 +0200 Message-Id: <20180724085426.23999-4-daniel@zonque.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180724085426.23999-1-daniel@zonque.org> References: <20180724085426.23999-1-daniel@zonque.org> Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In the error path of the IRQ handler, don't free the skb in flight. The callback in the digital core will do that for us. Doing it from both places causes a memory corruption. Signed-off-by: Daniel Mack --- drivers/nfc/st95hf/core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c index d58424ab5c48..d857197ec7b2 100644 --- a/drivers/nfc/st95hf/core.c +++ b/drivers/nfc/st95hf/core.c @@ -863,7 +863,6 @@ static irqreturn_t st95hf_irq_thread_handler(int irq, void *st95hfcontext) return IRQ_HANDLED; end: - kfree_skb(skb_resp); wtx = false; cb_arg->rats = false; skb_resp = ERR_PTR(result);