diff options
| author | Stephane Grosjean <s.grosjean@peak-system.com> | 2019-07-05 16:32:16 +0300 |
|---|---|---|
| committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2019-07-24 12:16:31 +0300 |
| commit | fee6a8923ae0d318a7f7950c6c6c28a96cea099b (patch) | |
| tree | 71cb3eb30d31075dc22ccc2192415afa4aab6344 /net | |
| parent | 5f186c257fa4808bb7f14e643b9fba3e11f08a30 (diff) | |
| download | linux-fee6a8923ae0d318a7f7950c6c6c28a96cea099b.tar.xz | |
can: peak_usb: fix potential double kfree_skb()
When closing the CAN device while tx skbs are inflight, echo skb could
be released twice. By calling close_candev() before unlinking all
pending tx urbs, then the internal echo_skb[] array is fully and
correctly cleared before the USB write callback and, therefore,
can_get_echo_skb() are called, for each aborted URB.
Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions