4.14-stable patches

added patches:
	can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch

diff --git a/queue-4.14/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch b/queue-4.14/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch
new file mode 100644 (file)
index 0000000..d5f7f59
--- /dev/null
+++ b/queue-4.14/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch
@@ -0,0 +1,42 @@
+From 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Nov 2021 17:50:41 +0300
+Subject: can: sja1000: fix use after free in ems_pcmcia_add_card()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 upstream.
+
+If the last channel is not available then "dev" is freed.  Fortunately,
+we can just use "pdev->irq" instead.
+
+Also we should check if at least one channel was set up.
+
+Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card")
+Link: https://lore.kernel.org/all/20211124145041.GB13656@kili
+Cc: stable@vger.kernel.org
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/sja1000/ems_pcmcia.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/sja1000/ems_pcmcia.c
++++ b/drivers/net/can/sja1000/ems_pcmcia.c
+@@ -243,7 +243,12 @@ static int ems_pcmcia_add_card(struct pc
+                       free_sja1000dev(dev);
+       }
+ 
+-      err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
++      if (!card->channels) {
++              err = -ENODEV;
++              goto failure_cleanup;
++      }
++
++      err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
+                         DRV_NAME, card);
+       if (!err)
+               return 0;

diff --git a/queue-4.14/series b/queue-4.14/series
index 779112f9e04d5c8430951563c495a6900dd58cd6..d9e28b65ce90081b04e36c9dd03c81306c45ea94 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -4,3 +4,4 @@ hid-add-usb_hid-dependancy-to-hid-chicony.patch
 hid-add-usb_hid-dependancy-on-some-usb-hid-drivers.patch
 hid-wacom-fix-problems-when-device-is-not-a-valid-usb-device.patch
 hid-check-for-valid-usb-device-for-many-hid-drivers.patch
+can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch