This is a note to let you know that I've just added the patch titled can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit() to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: can-kvaser_usb-fix-accessing-freed-memory-in-kvaser_usb_start_xmit.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From e13fb9b37cc00616b90df2d620f30345b5ada6ff Mon Sep 17 00:00:00 2001 From: Jimmy Assarsson <jimmyassarsson@xxxxxxxxx> Date: Mon, 6 Aug 2018 15:14:49 +0200 Subject: can: kvaser_usb: Fix accessing freed memory in kvaser_usb_start_xmit() From: Jimmy Assarsson <jimmyassarsson@xxxxxxxxx> commit e13fb9b37cc00616b90df2d620f30345b5ada6ff upstream. The call to can_put_echo_skb() may result in the skb being freed. The skb is later used in the call to dev->ops->dev_frame_to_cmd(). This is avoided by moving the call to can_put_echo_skb() after dev->ops->dev_frame_to_cmd(). Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Signed-off-by: Jimmy Assarsson <jimmyassarsson@xxxxxxxxx> Cc: linux-stable <stable@xxxxxxxxxxxxxxx> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -528,7 +528,6 @@ static netdev_tx_t kvaser_usb_start_xmit context = &priv->tx_contexts[i]; context->echo_index = i; - can_put_echo_skb(skb, netdev, context->echo_index); ++priv->active_tx_contexts; if (priv->active_tx_contexts >= (int)dev->max_tx_urbs) netif_stop_queue(netdev); @@ -553,7 +552,6 @@ static netdev_tx_t kvaser_usb_start_xmit dev_kfree_skb(skb); spin_lock_irqsave(&priv->tx_contexts_lock, flags); - can_free_echo_skb(netdev, context->echo_index); context->echo_index = dev->max_tx_urbs; --priv->active_tx_contexts; netif_wake_queue(netdev); @@ -564,6 +562,8 @@ static netdev_tx_t kvaser_usb_start_xmit context->priv = priv; + can_put_echo_skb(skb, netdev, context->echo_index); + usb_fill_bulk_urb(urb, dev->udev, usb_sndbulkpipe(dev->udev, dev->bulk_out->bEndpointAddress), Patches currently in stable-queue which might be from jimmyassarsson@xxxxxxxxx are queue-4.19/can-kvaser_usb-fix-potential-uninitialized-variable-use.patch queue-4.19/can-kvaser_usb-fix-accessing-freed-memory-in-kvaser_usb_start_xmit.patch