Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <20220311080208.45047-1-hbh25y@gmail.com>
In-Reply-To: <20220311080208.45047-1-hbh25y@gmail.com>
From:   Yasushi SHOJI <yashi@spacecubics.com>
Date:   Wed, 23 Mar 2022 08:08:16 +0900
Message-ID: <CAGLTpnK=4Gd8S488osvrbttkMvtsPy8eCGspV4-=z2N3UGZ5rw@mail.gmail.com>
Subject: Re: [PATCH] can: mcba_usb: fix possible double dev_kfree_skb in mcba_usb_start_xmit
To:     Hangyu Hua <hbh25y@gmail.com>
Cc:     Wolfgang Grandegger <wg@grandegger.com>,
        Marc Kleine-Budde <mkl@pengutronix.de>,
        David Miller <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        Vincent Mailhol <mailhol.vincent@wanadoo.fr>,
        stefan.maetje@esd.eu, Pavel Skripkin <paskripkin@gmail.com>,
        remigiusz.kollataj@mobica.com,
        linux-can <linux-can@vger.kernel.org>,
        netdev <netdev@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi Hangyu,

On Fri, Mar 11, 2022 at 5:02 PM Hangyu Hua <hbh25y@gmail.com> wrote:
>
> There is no need to call dev_kfree_skb when usb_submit_urb fails beacause
> can_put_echo_skb deletes original skb and can_free_echo_skb deletes the cloned
> skb.

So, it's more like, "we don't need to call dev_kfree_skb() after
can_put_echo_skb()
because can_put_echo_skb() consumes the given skb.".  It seems it doesn't depend
on the condition of usb_submit_urb().  Plus, we don't see the "cloned
skb" at the
call site.

Would you mind adding a comment on can_put_echo_skb(), in a separate patch,
saying the fact that it consumes the skb?

ems_usb.c, gs_usb.c and possibly some others seem to call
dev_kfree_skb() as well.
Are they affected?

Best,
-- 
           yashi