Commit 6d2f70ca authored by Dan Carpenter's avatar Dan Carpenter Committed by Samuel Ortiz

NFC: pn533: double free on error in probe()

We can't pass devm_ allocated pointers to kfree() because they will be
freed again after the drive is unloaded.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
parent f86dec94
...@@ -464,10 +464,8 @@ static int pn533_usb_probe(struct usb_interface *interface, ...@@ -464,10 +464,8 @@ static int pn533_usb_probe(struct usb_interface *interface,
return -ENOMEM; return -ENOMEM;
in_buf = kzalloc(in_buf_len, GFP_KERNEL); in_buf = kzalloc(in_buf_len, GFP_KERNEL);
if (!in_buf) { if (!in_buf)
rc = -ENOMEM; return -ENOMEM;
goto out_free_phy;
}
phy->udev = usb_get_dev(interface_to_usbdev(interface)); phy->udev = usb_get_dev(interface_to_usbdev(interface));
phy->interface = interface; phy->interface = interface;
...@@ -554,8 +552,7 @@ static int pn533_usb_probe(struct usb_interface *interface, ...@@ -554,8 +552,7 @@ static int pn533_usb_probe(struct usb_interface *interface,
usb_free_urb(phy->out_urb); usb_free_urb(phy->out_urb);
usb_put_dev(phy->udev); usb_put_dev(phy->udev);
kfree(in_buf); kfree(in_buf);
out_free_phy:
kfree(phy);
return rc; return rc;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment