| From 3d3925ff6433f98992685a9679613a2cc97f3ce2 Mon Sep 17 00:00:00 2001 |
| From: Hangyu Hua <hbh25y@gmail.com> |
| Date: Fri, 11 Mar 2022 16:06:14 +0800 |
| Subject: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path |
| |
| From: Hangyu Hua <hbh25y@gmail.com> |
| |
| commit 3d3925ff6433f98992685a9679613a2cc97f3ce2 upstream. |
| |
| There is no need to call dev_kfree_skb() when usb_submit_urb() fails |
| because can_put_echo_skb() deletes original skb and |
| can_free_echo_skb() deletes the cloned skb. |
| |
| Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") |
| Link: https://lore.kernel.org/all/20220311080614.45229-1-hbh25y@gmail.com |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Hangyu Hua <hbh25y@gmail.com> |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| [DP: adjusted params of can_free_echo_skb() for 5.4 stable] |
| Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/can/usb/usb_8dev.c | 30 ++++++++++++++---------------- |
| 1 file changed, 14 insertions(+), 16 deletions(-) |
| |
| --- a/drivers/net/can/usb/usb_8dev.c |
| +++ b/drivers/net/can/usb/usb_8dev.c |
| @@ -670,9 +670,20 @@ static netdev_tx_t usb_8dev_start_xmit(s |
| atomic_inc(&priv->active_tx_urbs); |
| |
| err = usb_submit_urb(urb, GFP_ATOMIC); |
| - if (unlikely(err)) |
| - goto failed; |
| - else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS) |
| + if (unlikely(err)) { |
| + can_free_echo_skb(netdev, context->echo_index); |
| + |
| + usb_unanchor_urb(urb); |
| + usb_free_coherent(priv->udev, size, buf, urb->transfer_dma); |
| + |
| + atomic_dec(&priv->active_tx_urbs); |
| + |
| + if (err == -ENODEV) |
| + netif_device_detach(netdev); |
| + else |
| + netdev_warn(netdev, "failed tx_urb %d\n", err); |
| + stats->tx_dropped++; |
| + } else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS) |
| /* Slow down tx path */ |
| netif_stop_queue(netdev); |
| |
| @@ -691,19 +702,6 @@ nofreecontext: |
| |
| return NETDEV_TX_BUSY; |
| |
| -failed: |
| - can_free_echo_skb(netdev, context->echo_index); |
| - |
| - usb_unanchor_urb(urb); |
| - usb_free_coherent(priv->udev, size, buf, urb->transfer_dma); |
| - |
| - atomic_dec(&priv->active_tx_urbs); |
| - |
| - if (err == -ENODEV) |
| - netif_device_detach(netdev); |
| - else |
| - netdev_warn(netdev, "failed tx_urb %d\n", err); |
| - |
| nomembuf: |
| usb_free_urb(urb); |
| |