diff options
| author | Jimmy Assarsson | 2018-08-06 15:14:49 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2018-11-27 16:13:09 +0100 |
| commit | 667bd202c5aa10d62afabd5b748bd6709227e88b (patch) | |
| tree | 550b09dcfb15f3f3947bfad5d39029fef482af46 /drivers/net/can | |
| parent | ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap() (diff) | |
| download | kernel-qcow2-linux-667bd202c5aa10d62afabd5b748bd6709227e88b.tar.gz kernel-qcow2-linux-667bd202c5aa10d62afabd5b748bd6709227e88b.tar.xz kernel-qcow2-linux-667bd202c5aa10d62afabd5b748bd6709227e88b.zip | |
can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit()
commit e13fb9b37cc00616b90df2d620f30345b5ada6ff upstream.
The call to can_put_echo_skb() may result in the skb being freed. The skb
is later used in the call to dev->ops->dev_frame_to_cmd().
This is avoided by moving the call to can_put_echo_skb() after
dev->ops->dev_frame_to_cmd().
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/net/can')
| -rw-r--r-- | drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c index b939a4c10b84..c89c7d4900d7 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, context = &priv->tx_contexts[i]; context->echo_index = i; - can_put_echo_skb(skb, netdev, context->echo_index); ++priv->active_tx_contexts; if (priv->active_tx_contexts >= (int)dev->max_tx_urbs) netif_stop_queue(netdev); @@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, dev_kfree_skb(skb); spin_lock_irqsave(&priv->tx_contexts_lock, flags); - can_free_echo_skb(netdev, context->echo_index); context->echo_index = dev->max_tx_urbs; --priv->active_tx_contexts; netif_wake_queue(netdev); @@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, context->priv = priv; + can_put_echo_skb(skb, netdev, context->echo_index); + usb_fill_bulk_urb(urb, dev->udev, usb_sndbulkpipe(dev->udev, dev->bulk_out->bEndpointAddress), |