[PATCH] can: gs_usb: fix size parameter to usb_free_coherent() calls

[Marc Kleine-Budde <mkl@pengutronix.de>]

In commit c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for
data in struct gs_host_frame") the driver was extended from a compile
time constant USB transfer size to a transfer size depending on
attached USB device and configured CAN mode.

During this conversion the size parameter of some usb_free_coherent()
calls were not converted. To fix this issue replace the compile time
constant sizeof(struct gs_host_frame) by hf_size_{rx,tx} for RX
respectively TX USB transfers.

Fixes: c359931d2545 ("can: gs_usb: use union and FLEX_ARRAY for data in struct gs_host_frame")
Cc: Peter Fink <pfink@christ-es.de>
Cc: stable@vger.kernel.org
Reported-by: Ryan Edwards <ryan.edwards@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/gs_usb.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index cd4115a1b81c..57917955b8e4 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -699,7 +699,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
 	return NETDEV_TX_OK;
 
  badidx:
-	usb_free_coherent(dev->udev, urb->transfer_buffer_length,
+	usb_free_coherent(dev->udev, dev->hf_size_tx,
 			  urb->transfer_buffer, urb->transfer_dma);
  nomem_hf:
 	usb_free_urb(urb);
@@ -787,7 +787,7 @@ static int gs_can_open(struct net_device *netdev)
 
 				usb_unanchor_urb(urb);
 				usb_free_coherent(dev->udev,
-						  sizeof(struct gs_host_frame),
+						  dev->parent->hf_size_rx,
 						  buf,
 						  buf_dma);
 				usb_free_urb(urb);
@@ -864,7 +864,7 @@ static int gs_can_close(struct net_device *netdev)
 		usb_kill_anchored_urbs(&parent->rx_submitted);
 		for (i = 0; i < GS_MAX_RX_URBS; i++)
 			usb_free_coherent(dev->udev,
-					  sizeof(struct gs_host_frame),
+					  dev->parent->hf_size_rx,
 					  dev->rxbuf[i],
 					  dev->rxbuf_dma[i]);
 	}
-- 
2.35.1