Return-path: Received: from aserp1040.oracle.com ([141.146.126.69]:45591 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751632AbdCHFX3 (ORCPT ); Wed, 8 Mar 2017 00:23:29 -0500 Date: Wed, 8 Mar 2017 08:22:37 +0300 From: Dan Carpenter To: Lauro Ramos Venancio , Vincent Cuissard Cc: Aloisio Almeida Jr , Samuel Ortiz , linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] NFC: nfcmrvl: double free on error path Message-ID: <20170308052237.GA14542@mwanda> (sfid-20170308_062532_484878_FAE075D9) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-wireless-owner@vger.kernel.org List-ID: The nci_spi_send() function calls kfree_skb(skb) on both error and success so this extra kfree_skb() is a double free. Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver") Signed-off-by: Dan Carpenter --- Static analysis. Not tested. diff --git a/drivers/nfc/nfcmrvl/spi.c b/drivers/nfc/nfcmrvl/spi.c index a7faa0bcc01e..fc8e78a29d77 100644 --- a/drivers/nfc/nfcmrvl/spi.c +++ b/drivers/nfc/nfcmrvl/spi.c @@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct nfcmrvl_private *priv, /* Send the SPI packet */ err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion, skb); - if (err != 0) { + if (err) nfc_err(priv->dev, "spi_send failed %d", err); - kfree_skb(skb); - } + return err; }