In commit c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for
data in struct gs_host_frame") the driver was extended from a compile
time constant USB transfer size to a transfer size depending on
attached USB device and configured CAN mode.
During this conversion the size parameter of some usb_free_coherent()
calls were not converted. To fix this issue replace the compile time
constant sizeof(struct gs_host_frame) by hf_size_{rx,tx} for RX
respectively TX USB transfers.
Fixes: c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for data in struct gs_host_frame")
Cc: Peter Fink <pfink@xxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Ryan Edwards <ryan.edwards@xxxxxxxxx>
Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
---
drivers/net/can/usb/gs_usb.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index cd4115a1b81c..57917955b8e4 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -699,7 +699,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
return NETDEV_TX_OK;
badidx:
- usb_free_coherent(dev->udev, urb->transfer_buffer_length,
+ usb_free_coherent(dev->udev, dev->hf_size_tx,
urb->transfer_buffer, urb->transfer_dma);
nomem_hf:
usb_free_urb(urb);
@@ -787,7 +787,7 @@ static int gs_can_open(struct net_device *netdev)
usb_unanchor_urb(urb);
usb_free_coherent(dev->udev,
- sizeof(struct gs_host_frame),
+ dev->parent->hf_size_rx,
buf,
buf_dma);
usb_free_urb(urb);
@@ -864,7 +864,7 @@ static int gs_can_close(struct net_device *netdev)
usb_kill_anchored_urbs(&parent->rx_submitted);
for (i = 0; i < GS_MAX_RX_URBS; i++)
usb_free_coherent(dev->udev,
- sizeof(struct gs_host_frame),
+ dev->parent->hf_size_rx,
dev->rxbuf[i],
dev->rxbuf_dma[i]);
}
--
2.35.1
