Unverified Commit cd53aeb4 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15322 can: m_can: m_can_tx_handler(): fix use after free of skb 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiangwei Li <liwei728@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/VEDAE444YYPPYFWXCKYTA55D2HS4I4XX/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBP6AL 
 
Link:https://gitee.com/openeuler/kernel/pulls/15322

 

Reviewed-by: default avatarXiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents edd5b39d 5063262b

drivers/net/can/m_can/m_can.c

+3 −2
Original line number Diff line number Diff line
@@ -1443,8 +1443,6 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb, 
					 M_CAN_FIFO_DATA(i / 4),

					 *(u32 *)(cf->data + i));



		can_put_echo_skb(skb, dev, 0);



		if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {

			cccr = m_can_read(priv, M_CAN_CCCR);

			cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
@@ -1461,6 +1459,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb, 
			m_can_write(priv, M_CAN_CCCR, cccr);

		}

		m_can_write(priv, M_CAN_TXBTIE, 0x1);



		can_put_echo_skb(skb, dev, 0);



		m_can_write(priv, M_CAN_TXBAR, 0x1);

		/* End of xmit function for version 3.0.x */

	} else {