Hello Greg, with v5.18-rc1 in commit | c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for data in struct gs_host_frame") a bug in the gs_usb driver in the usage of usb_free_coherent() was introduced. With v6.1-rc1 | 62f102c0d156 ("can: gs_usb: remove dma allocations") the DMA allocation was removed altogether from the driver, fixing the bug unintentionally. We can either cherry-pick 62f102c0d156 ("can: gs_usb: remove dma allocations") on v6.0, v5.19, and v5.18 or apply this patch, which fixes the usage of usb_free_coherent() only. regards, Marc On 25.11.2022 21:17:27, Marc Kleine-Budde wrote: > In commit c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for > data in struct gs_host_frame") the driver was extended from a compile > time constant USB transfer size to a transfer size depending on > attached USB device and configured CAN mode. > > During this conversion the size parameter of some usb_free_coherent() > calls were not converted. To fix this issue replace the compile time > constant sizeof(struct gs_host_frame) by hf_size_{rx,tx} for RX > respectively TX USB transfers. > > Fixes: c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for data in struct gs_host_frame") > Cc: Peter Fink <pfink@xxxxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx > Reported-by: Ryan Edwards <ryan.edwards@xxxxxxxxx> > Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx> > --- > drivers/net/can/usb/gs_usb.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c > index cd4115a1b81c..57917955b8e4 100644 > --- a/drivers/net/can/usb/gs_usb.c > +++ b/drivers/net/can/usb/gs_usb.c > @@ -699,7 +699,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, > return NETDEV_TX_OK; > > badidx: > - usb_free_coherent(dev->udev, urb->transfer_buffer_length, > + usb_free_coherent(dev->udev, dev->hf_size_tx, > urb->transfer_buffer, urb->transfer_dma); > nomem_hf: > usb_free_urb(urb); > @@ -787,7 +787,7 @@ static int gs_can_open(struct net_device *netdev) > > usb_unanchor_urb(urb); > usb_free_coherent(dev->udev, > - sizeof(struct gs_host_frame), > + dev->parent->hf_size_rx, > buf, > buf_dma); > usb_free_urb(urb); > @@ -864,7 +864,7 @@ static int gs_can_close(struct net_device *netdev) > usb_kill_anchored_urbs(&parent->rx_submitted); > for (i = 0; i < GS_MAX_RX_URBS; i++) > usb_free_coherent(dev->udev, > - sizeof(struct gs_host_frame), > + dev->parent->hf_size_rx, > dev->rxbuf[i], > dev->rxbuf_dma[i]); > } > -- > 2.35.1 > > > -- Pengutronix e.K. | Marc Kleine-Budde | Embedded Linux | https://www.pengutronix.de | Vertretung West/Dortmund | Phone: +49-231-2826-924 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
Attachment:
signature.asc
Description: PGP signature