diff options
| author | David S. Miller <davem@davemloft.net> | 2013-07-21 00:00:27 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-07-21 00:00:27 (GMT) |
| commit | 8d716c7a09e0db7458dc072dd518c991c922931f (patch) | |
| tree | c184c4834caa3faa589818d9e07683cfc2e934d3 /drivers/net | |
| parent | 1faabf2aab1fdaa1ace4e8c829d1b9cf7bfec2f1 (diff) | |
| parent | 7671986839f9207f8d76e8ef92b2d3f263a794cc (diff) | |
| download | linux-fsl-qoriq-8d716c7a09e0db7458dc072dd518c991c922931f.tar.xz | |
Merge branch 'fixes-for-3.11' of git://gitorious.org/linux-can/linux-can
Marc Kleine-Budde says:
====================
here are two fixes for the v3.11 release cycle:
Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
sanity checking to the data coming from the USB CAN adapter before using it.
Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
in the error handling of the USB 8dev's usb_8dev_start() function.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/can/usb/esd_usb2.c | 10 | ||||
| -rw-r--r-- | drivers/net/can/usb/usb_8dev.c | 1 |
2 files changed, 11 insertions, 0 deletions
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c index 6aa7b32..ac6177d 100644 --- a/drivers/net/can/usb/esd_usb2.c +++ b/drivers/net/can/usb/esd_usb2.c @@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb) switch (msg->msg.hdr.cmd) { case CMD_CAN_RX: + if (msg->msg.rx.net >= dev->net_count) { + dev_err(dev->udev->dev.parent, "format error\n"); + break; + } + esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg); break; case CMD_CAN_TX: + if (msg->msg.txdone.net >= dev->net_count) { + dev_err(dev->udev->dev.parent, "format error\n"); + break; + } + esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net], msg); break; diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c index cbd388e..8becd3d 100644 --- a/drivers/net/can/usb/usb_8dev.c +++ b/drivers/net/can/usb/usb_8dev.c @@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv) usb_unanchor_urb(urb); usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf, urb->transfer_dma); + usb_free_urb(urb); break; } |