[PATCH 4.4 046/134] NFC: nfcmrvl: double free on error path

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpen...@oracle.com>


[ Upstream commit ca42fb9e52d155547e6cf18cf26bce3e1a6af4ea ]

The nci_spi_send() function calls kfree_skb(skb) on both error and
success so this extra kfree_skb() is a double free.

Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver")
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>
Signed-off-by: Samuel Ortiz <sa...@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.le...@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 drivers/nfc/nfcmrvl/spi.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/drivers/nfc/nfcmrvl/spi.c
+++ b/drivers/nfc/nfcmrvl/spi.c
@@ -96,10 +96,9 @@ static int nfcmrvl_spi_nci_send(struct n
        /* Send the SPI packet */
        err = nci_spi_send(drv_data->nci_spi, &drv_data->handshake_completion,
                           skb);
-       if (err != 0) {
+       if (err)
                nfc_err(priv->dev, "spi_send failed %d", err);
-               kfree_skb(skb);
-       }
+
        return err;
 }