In the error path of the IRQ handler, don't free the skb in flight. The callback in the digital core will do that for us. Doing it from both places causes a memory corruption.
Signed-off-by: Daniel Mack <[email protected]> --- drivers/nfc/st95hf/core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c index d58424ab5c48..d857197ec7b2 100644 --- a/drivers/nfc/st95hf/core.c +++ b/drivers/nfc/st95hf/core.c @@ -863,7 +863,6 @@ static irqreturn_t st95hf_irq_thread_handler(int irq, void *st95hfcontext) return IRQ_HANDLED; end: - kfree_skb(skb_resp); wtx = false; cb_arg->rats = false; skb_resp = ERR_PTR(result); -- 2.17.1
