• Ahmed S. Darwish's avatar
    can: kvaser_usb: Don't free packets when tight on URBs · b442723f
    Ahmed S. Darwish authored
    Flooding the Kvaser CAN to USB dongle with multiple reads and
    writes in high frequency caused seemingly-random panics in the
    kernel.
    
    On further inspection, it seems the driver erroneously freed the
    to-be-transmitted packet upon getting tight on URBs and returning
    NETDEV_TX_BUSY, leading to invalid memory writes and double frees
    at a later point in time.
    
    Note:
    
    Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
    is a driver bug in and out of itself: it means that our start/stop
    queue flow control is broken.
    
    This patch only fixes the (buggy) error handling code; the root
    cause shall be fixed in a later commit.
    Acked-by: default avatarOlivier Sobrie <olivier@sobrie.be>
    Signed-off-by: default avatarAhmed S. Darwish <ahmed.darwish@valeo.com>
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
    b442723f
kvaser_usb.c 38.3 KB