err_ptr_deref: passing an ERR_PTR to kfree() is a bug