| From e13fb9b37cc00616b90df2d620f30345b5ada6ff Mon Sep 17 00:00:00 2001 |
| From: Jimmy Assarsson <jimmyassarsson@gmail.com> |
| Date: Mon, 6 Aug 2018 15:14:49 +0200 |
| Subject: can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit() |
| |
| From: Jimmy Assarsson <jimmyassarsson@gmail.com> |
| |
| commit e13fb9b37cc00616b90df2d620f30345b5ada6ff upstream. |
| |
| The call to can_put_echo_skb() may result in the skb being freed. The skb |
| is later used in the call to dev->ops->dev_frame_to_cmd(). |
| |
| This is avoided by moving the call to can_put_echo_skb() after |
| dev->ops->dev_frame_to_cmd(). |
| |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com> |
| Cc: linux-stable <stable@vger.kernel.org> |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c |
| +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c |
| @@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit |
| context = &priv->tx_contexts[i]; |
| |
| context->echo_index = i; |
| - can_put_echo_skb(skb, netdev, context->echo_index); |
| ++priv->active_tx_contexts; |
| if (priv->active_tx_contexts >= (int)dev->max_tx_urbs) |
| netif_stop_queue(netdev); |
| @@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit |
| dev_kfree_skb(skb); |
| spin_lock_irqsave(&priv->tx_contexts_lock, flags); |
| |
| - can_free_echo_skb(netdev, context->echo_index); |
| context->echo_index = dev->max_tx_urbs; |
| --priv->active_tx_contexts; |
| netif_wake_queue(netdev); |
| @@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit |
| |
| context->priv = priv; |
| |
| + can_put_echo_skb(skb, netdev, context->echo_index); |
| + |
| usb_fill_bulk_urb(urb, dev->udev, |
| usb_sndbulkpipe(dev->udev, |
| dev->bulk_out->bEndpointAddress), |
