CHROMIUM: virtwl: fix double free in error path for virtwl_ioctl_recv BUG=chromium:840161 TEST=None Change-Id: I18981885db705862d34e91b695f7323a1d52e3dd Signed-off-by: Zach Reizner <zachr@google.com> Reviewed-on: https://chromium-review.googlesource.com/1056146 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Mattias Nissler <mnissler@chromium.org> Reviewed-by: Alex Gaynor <alex.gaynor@gmail.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
diff --git a/drivers/virtio/virtio_wl.c b/drivers/virtio/virtio_wl.c index e14f84ed..2e5f9d6 100644 --- a/drivers/virtio/virtio_wl.c +++ b/drivers/virtio/virtio_wl.c
@@ -1049,10 +1049,9 @@ static long virtwl_ioctl_recv(struct file *filp, void __user *ptr) ret = anon_inode_getfd("[virtwl_vfd]", &virtwl_vfd_fops, vfds[i], virtwl_vfd_file_flags(vfds[i]) | O_CLOEXEC); - if (ret < 0) { - do_vfd_close(vfds[i]); + if (ret < 0) goto free_vfds; - } + vfds[i] = NULL; fds[i] = ret; }