Re: [patch] NFC: st21nfcb: double free on allocation error

Re: [patch] NFC: st21nfcb: double free on allocation error

[Christophe RICARD]

Hi Dan,

A patch fixing this issue got already sent to the linux-nfc mailing
list.
Here is a pointer to the patch:
https://lists.01.org/pipermail/linux-nfc/2014-July/002647.html

You are welcome to comment if anything is wrong.

Best Regards
Christophe
On Thu, 31 Jul 2014 12:41:23 +0300
Dan Carpenter <dan.carpenter@oracle.com> wrote:

> "info" is allocated with devm_kzalloc() so calling kfree() here will
> lead to a double free.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/nfc/st21nfcb/st21nfcb.c
> b/drivers/nfc/st21nfcb/st21nfcb.c index 4d95863..6944f9e 100644
> --- a/drivers/nfc/st21nfcb/st21nfcb.c
> +++ b/drivers/nfc/st21nfcb/st21nfcb.c
> @@ -94,8 +94,7 @@ int st21nfcb_nci_probe(struct llt_ndlc *ndlc, int
> phy_headroom, phy_headroom, phy_tailroom);
>  	if (!ndlc->ndev) {
>  		pr_err("Cannot allocate nfc ndev\n");
> -		r = -ENOMEM;
> -		goto err_alloc_ndev;
> +		return -ENOMEM;
>  	}
>  	info->ndlc = ndlc;
>  
> @@ -109,8 +108,6 @@ int st21nfcb_nci_probe(struct llt_ndlc *ndlc, int
> phy_headroom, err_regdev:
>  	nci_free_device(ndlc->ndev);
>  
> -err_alloc_ndev:
> -	kfree(info);
>  	return r;
>  }
>  EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);

[patch] NFC: st21nfcb: double free on allocation error

[Dan Carpenter]

"info" is allocated with devm_kzalloc() so calling kfree() here will
lead to a double free.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/nfc/st21nfcb/st21nfcb.c b/drivers/nfc/st21nfcb/st21nfcb.c
index 4d95863..6944f9e 100644
--- a/drivers/nfc/st21nfcb/st21nfcb.c
+++ b/drivers/nfc/st21nfcb/st21nfcb.c
@@ -94,8 +94,7 @@ int st21nfcb_nci_probe(struct llt_ndlc *ndlc, int phy_headroom,
 					phy_headroom, phy_tailroom);
 	if (!ndlc->ndev) {
 		pr_err("Cannot allocate nfc ndev\n");
-		r = -ENOMEM;
-		goto err_alloc_ndev;
+		return -ENOMEM;
 	}
 	info->ndlc = ndlc;
 
@@ -109,8 +108,6 @@ int st21nfcb_nci_probe(struct llt_ndlc *ndlc, int phy_headroom,
 err_regdev:
 	nci_free_device(ndlc->ndev);
 
-err_alloc_ndev:
-	kfree(info);
 	return r;
 }
 EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);