Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 777DCC432C2
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH] rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup()
From:   Kalle Valo <kvalo@codeaurora.org>
In-Reply-To: <20200513093951.GD347693@mwanda>
References: <20200513093951.GD347693@mwanda>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Ping-Ke Shih <pkshih@realtek.com>,
        Jussi Kivilinna <jussi.kivilinna@iki.fi>,
        linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
User-Agent: pwcli/0.1.0-git (https://github.com/kvalo/pwcli/) Python/3.5.2
Message-Id: <20200518121543.E2B76C43637@smtp.codeaurora.org>
Date:   Mon, 18 May 2020 12:15:43 +0000 (UTC)
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Dan Carpenter <dan.carpenter@oracle.com> wrote:

> Seven years ago we tried to fix a leak but actually introduced a double
> free instead.  It was an understandable mistake because the code was a
> bit confusing and the free was done in the wrong place.  The "skb"
> pointer is freed in both _rtl_usb_tx_urb_setup() and _rtl_usb_transmit().
> The free belongs _rtl_usb_transmit() instead of _rtl_usb_tx_urb_setup()
> and I've cleaned the code up a bit to hopefully make it more clear.
> 
> Fixes: 36ef0b473fbf ("rtlwifi: usb: add missing freeing of skbuff")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Patch applied to wireless-drivers-next.git, thanks.

beb12813bc75 rtlwifi: Fix a double free in _rtl_usb_tx_urb_setup()

-- 
https://patchwork.kernel.org/patch/11545535/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches