[PATCH 3.13.y-ckt 080/103] can: kvaser_usb: Don't free packets when tight on URBs

From: Kamal Mostafa
Date: Wed Feb 18 2015 - 19:43:12 EST

3.13.11-ckt16 -stable review patch. If anyone has any objections, please let me know.


From: "Ahmed S. Darwish" <ahmed.darwish@xxxxxxxxx>

commit b442723fcec445fb0ae1104888dd22cd285e0a91 upstream.

Flooding the Kvaser CAN to USB dongle with multiple reads and
writes in high frequency caused seemingly-random panics in the

On further inspection, it seems the driver erroneously freed the
to-be-transmitted packet upon getting tight on URBs and returning
NETDEV_TX_BUSY, leading to invalid memory writes and double frees
at a later point in time.


Finding no more URBs/transmit-contexts and returning NETDEV_TX_BUSY
is a driver bug in and out of itself: it means that our start/stop
queue flow control is broken.

This patch only fixes the (buggy) error handling code; the root
cause shall be fixed in a later commit.

Acked-by: Olivier Sobrie <olivier@xxxxxxxxx>
Signed-off-by: Ahmed S. Darwish <ahmed.darwish@xxxxxxxxx>
Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
Signed-off-by: Kamal Mostafa <kamal@xxxxxxxxxxxxx>
drivers/net/can/usb/kvaser_usb.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
index cc3df8a..f6e30be 100644
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -1286,12 +1286,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
if (!urb) {
netdev_err(netdev, "No memory left for URBs\n");
- goto nourbmem;
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;

buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
if (!buf) {
+ dev_kfree_skb(skb);
goto nobufmem;

@@ -1326,6 +1328,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,

+ /* This should never happen; it implies a flow control bug */
if (!context) {
netdev_warn(netdev, "cannot find free context\n");
@@ -1356,9 +1359,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
if (unlikely(err)) {
can_free_echo_skb(netdev, context->echo_index);

- skb = NULL; /* set to NULL to avoid double free in
- * dev_kfree_skb(skb) */

@@ -1380,8 +1380,6 @@ releasebuf:
- dev_kfree_skb(skb);
return ret;


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/