]> git.baikalelectronics.ru Git - kernel.git/commit
can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit()
authorJimmy Assarsson <jimmyassarsson@gmail.com>
Mon, 6 Aug 2018 13:14:49 +0000 (15:14 +0200)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Fri, 9 Nov 2018 16:20:03 +0000 (17:20 +0100)
commitdb7f577010ebf89c915bd51830cfeff03884ffe1
tree817f41d9635fe0224ab9d71ec20346353f2379b0
parenta31616334e82aab4dd957ce2f043a3405fbbfa8d
can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit()

The call to can_put_echo_skb() may result in the skb being freed. The skb
is later used in the call to dev->ops->dev_frame_to_cmd().

This is avoided by moving the call to can_put_echo_skb() after
dev->ops->dev_frame_to_cmd().

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c