Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 667bd202 authored by Jimmy Assarsson's avatar Jimmy Assarsson Committed by Greg Kroah-Hartman
Browse files

can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit() 



commit e13fb9b37cc00616b90df2d620f30345b5ada6ff upstream.

The call to can_put_echo_skb() may result in the skb being freed. The skb
is later used in the call to dev->ops->dev_frame_to_cmd().

This is avoided by moving the call to can_put_echo_skb() after
dev->ops->dev_frame_to_cmd().

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJimmy Assarsson <jimmyassarsson@gmail.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a0d5745e

drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c

+2 −2
Original line number Diff line number Diff line
@@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, 
			context = &priv->tx_contexts[i];



			context->echo_index = i;

			can_put_echo_skb(skb, netdev, context->echo_index);

			++priv->active_tx_contexts;

			if (priv->active_tx_contexts >= (int)dev->max_tx_urbs)

				netif_stop_queue(netdev);
@@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, 
		dev_kfree_skb(skb);

		spin_lock_irqsave(&priv->tx_contexts_lock, flags);



		can_free_echo_skb(netdev, context->echo_index);

		context->echo_index = dev->max_tx_urbs;

		--priv->active_tx_contexts;

		netif_wake_queue(netdev);
@@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, 


	context->priv = priv;



	can_put_echo_skb(skb, netdev, context->echo_index);



	usb_fill_bulk_urb(urb, dev->udev,

			  usb_sndbulkpipe(dev->udev,

					  dev->bulk_out->bEndpointAddress),