From: Hangyu Hua <hbh25y@xxxxxxxxx> commit c70222752228a62135cee3409dccefd494a24646 upstream. There is no need to call dev_kfree_skb() when usb_submit_urb() fails beacause can_put_echo_skb() deletes the original skb and can_free_echo_skb() deletes the cloned skb. Link: https://lore.kernel.org/all/20220228083639.38183-1-hbh25y@xxxxxxxxx Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") Cc: stable@xxxxxxxxxxxxxxx Cc: Sebastian Haas <haas@xxxxxxxxxxxxxxxx> Signed-off-by: Hangyu Hua <hbh25y@xxxxxxxxx> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/can/usb/ems_usb.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/can/usb/ems_usb.c +++ b/drivers/net/can/usb/ems_usb.c @@ -819,7 +819,6 @@ static netdev_tx_t ems_usb_start_xmit(st usb_unanchor_urb(urb); usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); - dev_kfree_skb(skb); atomic_dec(&dev->active_tx_urbs); Patches currently in stable-queue which might be from hbh25y@xxxxxxxxx are queue-5.17/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch queue-5.17/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch queue-5.17/can-ems_usb-ems_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch