rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository.
Vulnerability ID: CVE-2022-24813
CWE: CWE-287
Severity score: 2.9
Project: https://github.com/miraheze/CreateWiki
Published: 2022-04-04
File: includes/RequestWiki/RequestWikiRequestViewer.php
Commit message: T9018: Add submission check for anonymous users POSTing
Commit author: John F. Lewis

Vulnerable version (before fix):
 protected function submitForm( 		WikiRequest $request 	) { 		$out = $form->getContext()->getOutput();  		if ( isset( $formData['submit-comment'] ) ) { 			$request->addComment( $formData['comment'], $form->getUser() ); 		} elseif ( isset( $formData['submit-edit'] ) ) { 			$subdomain = $formData['edit-url']; 			$err = ''; protected function submitForm( 			$request->visibility = $formData['visibility'];  			if ( $formData['submission-action'] == 'approve' ) { 				$request->approve( $form->getUser(), $formData['reason'] ); 			} else { 				$request->decline( $formData['reason'], $form->getUser() ); 			} 		} 

Fixed version (after fix):
 protected function submitForm( 		WikiRequest $request 	) { 		$out = $form->getContext()->getOutput(); 		$user = $form->getUser();  		if ( $user->isAnon() ) { 			$out->addHTML( Html::errorBox( wfMessage( 'exception-nologin-text' )->parse() ) ); 			 			return false; 		} elseif ( isset( $formData['submit-comment'] ) ) { 			$request->addComment( $formData['comment'], $user ); 		} elseif ( isset( $formData['submit-edit'] ) ) { 			$subdomain = $formData['edit-url']; 			$err = ''; protected function submitForm( 			$request->visibility = $formData['visibility'];  			if ( $formData['submission-action'] == 'approve' ) { 				$request->approve( $user, $formData['reason'] ); 			} else { 				$request->decline( $formData['reason'], $user ); 			} 		} 

Patch:
patch: @@ -331,9 +331,14 @@ protected function submitForm(
 		WikiRequest $request
 	) {
 		$out = $form->getContext()->getOutput();
-
-		if ( isset( $formData['submit-comment'] ) ) {
-			$request->addComment( $formData['comment'], $form->getUser() );
+		$user = $form->getUser();
+
+		if ( $user->isAnon() ) {
+			$out->addHTML( Html::errorBox( wfMessage( 'exception-nologin-text' )->parse() ) );
+			
+			return false;
+		} elseif ( isset( $formData['submit-comment'] ) ) {
+			$request->addComment( $formData['comment'], $user );
 		} elseif ( isset( $formData['submit-edit'] ) ) {
 			$subdomain = $formData['edit-url'];
 			$err = '';
@@ -359,9 +364,9 @@ protected function submitForm(
 			$request->visibility = $formData['visibility'];
 
 			if ( $formData['submission-action'] == 'approve' ) {
-				$request->approve( $form->getUser(), $formData['reason'] );
+				$request->approve( $user, $formData['reason'] );
 			} else {
-				$request->decline( $formData['reason'], $form->getUser() );
+				$request->decline( $formData['reason'], $user );
 			}
 		}
path: includes/RequestWiki/RequestWikiRequestViewer.php
Vulnerability: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade.
Vulnerability ID: CVE-2022-24869
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2022-04-21
File: src/Toolbox.php
Commit message: Merge pull request from GHSA-p94c-8qp5-gfpx
Commit author: Cédric Anne

Vulnerable version (before fix):
 public static function unclean_cross_side_scripting_deep($value)     public static function getHtmLawedSafeConfig(): array     {         $config = [             'elements'         => '* -applet -canvas -embed -form -object -script',             'deny_attribute'   => 'on*, srcdoc',             'comment'          => 1, // 1: remove HTML comments (and do not display their contents)             'cdata'            => 1, // 1: remove CDATA sections (and do not display their contents)

Fixed version (after fix):
 public static function unclean_cross_side_scripting_deep($value)     public static function getHtmLawedSafeConfig(): array     {         $config = [             'elements'         => '* -applet -canvas -embed -form -object -script -link',             'deny_attribute'   => 'on*, srcdoc',             'comment'          => 1, // 1: remove HTML comments (and do not display their contents)             'cdata'            => 1, // 1: remove CDATA sections (and do not display their contents)

Patch:
patch: @@ -309,7 +309,7 @@ public static function unclean_cross_side_scripting_deep($value)
     public static function getHtmLawedSafeConfig(): array
     {
         $config = [
-            'elements'         => '* -applet -canvas -embed -form -object -script',
+            'elements'         => '* -applet -canvas -embed -form -object -script -link',
             'deny_attribute'   => 'on*, srcdoc',
             'comment'          => 1, // 1: remove HTML comments (and do not display their contents)
             'cdata'            => 1, // 1: remove CDATA sections (and do not display their contents)
path: src/Toolbox.php
Vulnerability: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability ID: CVE-2022-24876
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/glpi-project/glpi
Published: 2022-06-09
File: js/modules/Kanban/Kanban.js
Commit message: Merge pull request from GHSA-33g2-m556-gccr
Commit author: Cédric Anne

Vulnerable version (before fix):
  import SearchInput from "../SearchTokenizer/SearchInput.js";  /* global sortable */ /* global glpi_toast_error */  class GLPIKanbanRights {                     l.append(`                      <div class="member-details">                         ${member_item}                         ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}                      </div>                      <button type="button" name="delete" class="btn btn-ghost-danger">                         <i class="ti ti-x" title="${__('Delete')}"></i>

Fixed version (after fix):
  import SearchInput from "../SearchTokenizer/SearchInput.js";  /* global escapeMarkupText */ /* global sortable */ /* global glpi_toast_error */  class GLPIKanbanRights {                     l.append(`                      <div class="member-details">                         ${member_item}                         ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}                      </div>                      <button type="button" name="delete" class="btn btn-ghost-danger">                         <i class="ti ti-x" title="${__('Delete')}"></i>

Patch:
patch: @@ -33,6 +33,7 @@
 
 import SearchInput from "../SearchTokenizer/SearchInput.js";
 
+/* global escapeMarkupText */
 /* global sortable */
 /* global glpi_toast_error */
 
@@ -2447,7 +2448,7 @@ class GLPIKanbanRights {
                     l.append(`
                      <div class="member-details">
                         ${member_item}
-                        ${l.attr('data-name') || `${member_itemtype} (${member_items_id})`}
+                        ${escapeMarkupText(l.attr('data-name')) || `${member_itemtype} (${member_items_id})`}
                      </div>
                      <button type="button" name="delete" class="btn btn-ghost-danger">
                         <i class="ti ti-x" title="${__('Delete')}"></i>
path: js/modules/Kanban/Kanban.js
Vulnerability: An issue was discovered in the Linux kernel before 5.16.5. There is a memory leak in yam_siocdevprivate in drivers/net/hamradio/yam.c.
Vulnerability ID: CVE-2022-24959
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2022-02-11
File: drivers/net/hamradio/yam.c
Commit message: yam: fix a memory leak in yam_siocdevprivate()

ym needs to be free when ym->cmd != SIOCYAMSMCS.

Fixes: 0781168e23a2 ("yam: fix a missing-check bug")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static int yam_siocdevprivate(struct net_device *dev, struct ifreq *ifr, void __ 		ym = memdup_user(data, sizeof(struct yamdrv_ioctl_mcs)); 		if (IS_ERR(ym)) 			return PTR_ERR(ym); 		if (ym->cmd != SIOCYAMSMCS) 			return -EINVAL; 		if (ym->bitrate > YAM_MAXBITRATE) { 			kfree(ym); 			return -EINVAL; 		}

Fixed version (after fix):
 static int yam_siocdevprivate(struct net_device *dev, struct ifreq *ifr, void __ 		ym = memdup_user(data, sizeof(struct yamdrv_ioctl_mcs)); 		if (IS_ERR(ym)) 			return PTR_ERR(ym); 		if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) { 			kfree(ym); 			return -EINVAL; 		}

Patch:
patch: @@ -950,9 +950,7 @@ static int yam_siocdevprivate(struct net_device *dev, struct ifreq *ifr, void __
 		ym = memdup_user(data, sizeof(struct yamdrv_ioctl_mcs));
 		if (IS_ERR(ym))
 			return PTR_ERR(ym);
-		if (ym->cmd != SIOCYAMSMCS)
-			return -EINVAL;
-		if (ym->bitrate > YAM_MAXBITRATE) {
+		if (ym->cmd != SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) {
 			kfree(ym);
 			return -EINVAL;
 		}
path: drivers/net/hamradio/yam.c
Vulnerability: An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem lacks certain validation of interface OS descriptor requests (ones with a large array index and ones associated with NULL function pointer retrieval). Memory corruption might occur.
Vulnerability ID: CVE-2022-25258
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2022-02-16
File: drivers/usb/gadget/composite.c
Commit message: USB: gadget: validate interface OS descriptor requests

Stall the control endpoint in case provided index exceeds array size of
MAX_CONFIG_INTERFACES or when the retrieved function pointer is null.

Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Szymon Heidrich

Vulnerable version (before fix):
 composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 				if (w_index != 0x5 || (w_value >> 8)) 					break; 				interface = w_value & 0xFF; 				buf[6] = w_index; 				count = count_ext_prop(os_desc_cfg, 					interface);

Fixed version (after fix):
 composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) 				if (w_index != 0x5 || (w_value >> 8)) 					break; 				interface = w_value & 0xFF; 				if (interface >= MAX_CONFIG_INTERFACES || 				    !os_desc_cfg->interface[interface]) 					break; 				buf[6] = w_index; 				count = count_ext_prop(os_desc_cfg, 					interface);

Patch:
patch: @@ -1988,6 +1988,9 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
 				if (w_index != 0x5 || (w_value >> 8))
 					break;
 				interface = w_value & 0xFF;
+				if (interface >= MAX_CONFIG_INTERFACES ||
+				    !os_desc_cfg->interface[interface])
+					break;
 				buf[6] = w_index;
 				count = count_ext_prop(os_desc_cfg,
 					interface);
path: drivers/usb/gadget/composite.c
Vulnerability: st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows because of untrusted length parameters.
Vulnerability ID: CVE-2022-26490
CWE: CWE-120
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2022-03-06
File: drivers/nfc/st21nfca/se.c
Commit message: nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION

It appears that there are some buffer overflows in EVT_TRANSACTION.
This happens because the length parameters that are passed to memcpy
come directly from skb->data and are not guarded in any way.

Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Jordy Zomer

Vulnerable version (before fix):
 int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 			return -ENOMEM;  		transaction->aid_len = skb->data[1]; 		memcpy(transaction->aid, &skb->data[2], 		       transaction->aid_len);  int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 			return -EPROTO;  		transaction->params_len = skb->data[transaction->aid_len + 3]; 		memcpy(transaction->params, skb->data + 		       transaction->aid_len + 4, transaction->params_len); 

Fixed version (after fix):
 int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 			return -ENOMEM;  		transaction->aid_len = skb->data[1];  		/* Checking if the length of the AID is valid */ 		if (transaction->aid_len > sizeof(transaction->aid)) 			return -EINVAL;  		memcpy(transaction->aid, &skb->data[2], 		       transaction->aid_len);  int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, 			return -EPROTO;  		transaction->params_len = skb->data[transaction->aid_len + 3];  		/* Total size is allocated (skb->len - 2) minus fixed array members */ 		if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) 			return -EINVAL;  		memcpy(transaction->params, skb->data + 		       transaction->aid_len + 4, transaction->params_len); 

Patch:
patch: @@ -316,6 +316,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
 			return -ENOMEM;
 
 		transaction->aid_len = skb->data[1];
+
+		/* Checking if the length of the AID is valid */
+		if (transaction->aid_len > sizeof(transaction->aid))
+			return -EINVAL;
+
 		memcpy(transaction->aid, &skb->data[2],
 		       transaction->aid_len);
 
@@ -325,6 +330,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
 			return -EPROTO;
 
 		transaction->params_len = skb->data[transaction->aid_len + 3];
+
+		/* Total size is allocated (skb->len - 2) minus fixed array members */
+		if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction)))
+			return -EINVAL;
+
 		memcpy(transaction->params, skb->data +
 		       transaction->aid_len + 4, transaction->params_len);
path: drivers/nfc/st21nfca/se.c
Vulnerability: In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
Vulnerability ID: CVE-2022-27239
CWE: CWE-787
Severity score: 10
Project: https://github.com/piastry/cifs-utils
Published: 2022-04-27
File: mount.cifs.c
Commit message: CVE-2022-27239: mount.cifs: fix length check for ip option parsing

Previous check was true whatever the length of the input string was,
leading to a buffer overflow in the subsequent strcpy call.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15025

Signed-off-by: Jeffrey Bencteux <jbe@improsec.com>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Commit author: Jeffrey Bencteux

Vulnerable version (before fix):
 parse_options(const char *data, struct parsed_mount_info *parsed_info) 			if (!value || !*value) { 				fprintf(stderr, 					"target ip address argument missing\n"); 			} else if (strnlen(value, MAX_ADDRESS_LEN) <= 				MAX_ADDRESS_LEN) { 				strcpy(parsed_info->addrlist, value); 				if (parsed_info->verboseflag) 					fprintf(stderr, 						"ip address %s override specified\n",

Fixed version (after fix):
 parse_options(const char *data, struct parsed_mount_info *parsed_info) 			if (!value || !*value) { 				fprintf(stderr, 					"target ip address argument missing\n"); 			} else if (strnlen(value, MAX_ADDRESS_LEN) < 				MAX_ADDRESS_LEN) { 				strlcpy(parsed_info->addrlist, value, 					MAX_ADDRESS_LEN); 				if (parsed_info->verboseflag) 					fprintf(stderr, 						"ip address %s override specified\n",

Patch:
patch: @@ -926,9 +926,10 @@ parse_options(const char *data, struct parsed_mount_info *parsed_info)
 			if (!value || !*value) {
 				fprintf(stderr,
 					"target ip address argument missing\n");
-			} else if (strnlen(value, MAX_ADDRESS_LEN) <=
+			} else if (strnlen(value, MAX_ADDRESS_LEN) <
 				MAX_ADDRESS_LEN) {
-				strcpy(parsed_info->addrlist, value);
+				strlcpy(parsed_info->addrlist, value,
+					MAX_ADDRESS_LEN);
 				if (parsed_info->verboseflag)
 					fprintf(stderr,
 						"ip address %s override specified\n",
path: mount.cifs.c
Vulnerability: Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
Vulnerability ID: CVE-2022-27475
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/tramyardg/hotel-mgmt-system
Published: 2022-04-13
File: app/Util.php
Commit message: + sanitize xss function
Commit author: Raymart De Guzman

Vulnerable version (before fix):
 public static function displayAlertV2($message, $type)           <p class="mb-0">' . $message["footer"] . '</p>         </div>';     } }

Fixed version (after fix):
 public static function displayAlertV2($message, $type)           <p class="mb-0">' . $message["footer"] . '</p>         </div>';     }      public static function sanitize_xss($value)      {       return htmlspecialchars(strip_tags($value));     }           }

Patch:
patch: @@ -36,4 +36,11 @@ public static function displayAlertV2($message, $type)
           <p class="mb-0">' . $message["footer"] . '</p>
         </div>';
     }
+
+    public static function sanitize_xss($value) 
+    {
+      return htmlspecialchars(strip_tags($value));
+    }
+      
+  
 }
path: app/Util.php
Vulnerability: In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.
Vulnerability ID: CVE-2022-27950
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2022-03-28
File: drivers/hid/hid-elo.c
Commit message: HID: elo: fix memory leak in elo_probe

When hid_parse() in elo_probe() fails, it forgets to call usb_put_dev to
decrease the refcount.

Fix this by adding usb_put_dev() in the error handling code of elo_probe().

Fixes: fbf42729d0e9 ("HID: elo: update the reference count of the usb device structure")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit author: Dongliang Mu

Vulnerable version (before fix):
 static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)  	return 0; err_free: 	kfree(priv); 	return ret; }

Fixed version (after fix):
 static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)  	return 0; err_free: 	usb_put_dev(udev); 	kfree(priv); 	return ret; }

Patch:
patch: @@ -262,6 +262,7 @@ static int elo_probe(struct hid_device *hdev, const struct hid_device_id *id)
 
 	return 0;
 err_free:
+	usb_put_dev(udev);
 	kfree(priv);
 	return ret;
 }
path: drivers/hid/hid-elo.c
Vulnerability: mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.
Vulnerability ID: CVE-2022-28389
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2022-04-03
File: drivers/net/can/usb/mcba_usb.c
Commit message: can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path

There is no need to call dev_kfree_skb() when usb_submit_urb() fails
because can_put_echo_skb() deletes original skb and
can_free_echo_skb() deletes the cloned skb.

Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Link: https://lore.kernel.org/all/20220311080208.45047-1-hbh25y@gmail.com
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, xmit_failed: 	can_free_echo_skb(priv->netdev, ctx->ndx, NULL); 	mcba_usb_free_ctx(ctx); 	dev_kfree_skb(skb); 	stats->tx_dropped++;  	return NETDEV_TX_OK;

Fixed version (after fix):
 static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, xmit_failed: 	can_free_echo_skb(priv->netdev, ctx->ndx, NULL); 	mcba_usb_free_ctx(ctx); 	stats->tx_dropped++;  	return NETDEV_TX_OK;

Patch:
patch: @@ -364,7 +364,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
 xmit_failed:
 	can_free_echo_skb(priv->netdev, ctx->ndx, NULL);
 	mcba_usb_free_ctx(ctx);
-	dev_kfree_skb(skb);
 	stats->tx_dropped++;
 
 	return NETDEV_TX_OK;
path: drivers/net/can/usb/mcba_usb.c
Vulnerability: ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
Vulnerability ID: CVE-2022-28390
CWE: CWE-415
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2022-04-03
File: drivers/net/can/usb/ems_usb.c
Commit message: can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path

There is no need to call dev_kfree_skb() when usb_submit_urb() fails
beacause can_put_echo_skb() deletes the original skb and
can_free_echo_skb() deletes the cloned skb.

Link: https://lore.kernel.org/all/20220228083639.38183-1-hbh25y@gmail.com
Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Cc: stable@vger.kernel.org
Cc: Sebastian Haas <haas@ems-wuensche.com>
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne  		usb_unanchor_urb(urb); 		usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); 		dev_kfree_skb(skb);  		atomic_dec(&dev->active_tx_urbs); 

Fixed version (after fix):
 static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne  		usb_unanchor_urb(urb); 		usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);  		atomic_dec(&dev->active_tx_urbs); 

Patch:
patch: @@ -819,7 +819,6 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne
 
 		usb_unanchor_urb(urb);
 		usb_free_coherent(dev->udev, size, buf, urb->transfer_dma);
-		dev_kfree_skb(skb);
 
 		atomic_dec(&dev->active_tx_urbs);
path: drivers/net/can/usb/ems_usb.c