commit 47898217b8005ae4c181670fa285da1067fca1a0
author Zach Reizner <zachr@google.com> Fri May 11 14:49:55 2018 -0700
committer Tim Detwiler <tjdetwiler@google.com> Tue Oct 09 16:36:11 2018 -0700
tree be58c550e2152a490f5b391179157c7b12c5a6d8
parent 9a1b4e920a771f475d92921d98e2a7b5221c12a9

CHROMIUM: virtwl: fix double free in error path for virtwl_ioctl_recv

BUG=chromium:840161
TEST=None

Change-Id: I18981885db705862d34e91b695f7323a1d52e3dd
Signed-off-by: Zach Reizner <zachr@google.com>
Reviewed-on: https://chromium-review.googlesource.com/1056146
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Alex Gaynor <alex.gaynor@gmail.com>
Reviewed-by: Zach Reizner <zachr@chromium.org>

drivers/virtio/virtio_wl.c

diff --git a/drivers/virtio/virtio_wl.c b/drivers/virtio/virtio_wl.c
index e14f84ed..2e5f9d6 100644
--- a/drivers/virtio/virtio_wl.c
+++ b/drivers/virtio/virtio_wl.c
@@ -1049,10 +1049,9 @@ static long virtwl_ioctl_recv(struct file *filp, void __user *ptr)
 		ret = anon_inode_getfd("[virtwl_vfd]", &virtwl_vfd_fops,
 				       vfds[i], virtwl_vfd_file_flags(vfds[i])
 				       | O_CLOEXEC);
-		if (ret < 0) {
-			do_vfd_close(vfds[i]);
+		if (ret < 0)
 			goto free_vfds;
-		}
+
 		vfds[i] = NULL;
 		fds[i] = ret;
 	}