5.10-stable patches

added patches:
	can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
	can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch

diff --git a/queue-5.10/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch b/queue-5.10/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
new file mode 100644 (file)
index 0000000..052a0d0
--- /dev/null
+++ b/queue-5.10/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
@@ -0,0 +1,44 @@
+From 2e8e79c416aae1de224c0f1860f2e3350fa171f8 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Thu, 17 Mar 2022 08:57:35 +0100
+Subject: can: m_can: m_can_tx_handler(): fix use after free of skb
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream.
+
+can_put_echo_skb() will clone skb then free the skb. Move the
+can_put_echo_skb() for the m_can version 3.0.x directly before the
+start of the xmit in hardware, similar to the 3.1.x branch.
+
+Fixes: 80646733f11c ("can: m_can: update to support CAN FD features")
+Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de
+Cc: stable@vger.kernel.org
+Reported-by: Hangyu Hua <hbh25y@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/m_can/m_can.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1491,8 +1491,6 @@ static netdev_tx_t m_can_tx_handler(stru
+                                        M_CAN_FIFO_DATA(i / 4),
+                                        *(u32 *)(cf->data + i));
+ 
+-              can_put_echo_skb(skb, dev, 0);
+-
+               if (cdev->can.ctrlmode & CAN_CTRLMODE_FD) {
+                       cccr = m_can_read(cdev, M_CAN_CCCR);
+                       cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+@@ -1509,6 +1507,9 @@ static netdev_tx_t m_can_tx_handler(stru
+                       m_can_write(cdev, M_CAN_CCCR, cccr);
+               }
+               m_can_write(cdev, M_CAN_TXBTIE, 0x1);
++
++              can_put_echo_skb(skb, dev, 0);
++
+               m_can_write(cdev, M_CAN_TXBAR, 0x1);
+               /* End of xmit function for version 3.0.x */
+       } else {

diff --git a/queue-5.10/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch b/queue-5.10/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch
new file mode 100644 (file)
index 0000000..75e6348
--- /dev/null
+++ b/queue-5.10/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch
@@ -0,0 +1,69 @@
+From 3d3925ff6433f98992685a9679613a2cc97f3ce2 Mon Sep 17 00:00:00 2001
+From: Hangyu Hua <hbh25y@gmail.com>
+Date: Fri, 11 Mar 2022 16:06:14 +0800
+Subject: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path
+
+From: Hangyu Hua <hbh25y@gmail.com>
+
+commit 3d3925ff6433f98992685a9679613a2cc97f3ce2 upstream.
+
+There is no need to call dev_kfree_skb() when usb_submit_urb() fails
+because can_put_echo_skb() deletes original skb and
+can_free_echo_skb() deletes the cloned skb.
+
+Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices")
+Link: https://lore.kernel.org/all/20220311080614.45229-1-hbh25y@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/usb/usb_8dev.c |   30 ++++++++++++++----------------
+ 1 file changed, 14 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/can/usb/usb_8dev.c
++++ b/drivers/net/can/usb/usb_8dev.c
+@@ -670,9 +670,20 @@ static netdev_tx_t usb_8dev_start_xmit(s
+       atomic_inc(&priv->active_tx_urbs);
+ 
+       err = usb_submit_urb(urb, GFP_ATOMIC);
+-      if (unlikely(err))
+-              goto failed;
+-      else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
++      if (unlikely(err)) {
++              can_free_echo_skb(netdev, context->echo_index);
++
++              usb_unanchor_urb(urb);
++              usb_free_coherent(priv->udev, size, buf, urb->transfer_dma);
++
++              atomic_dec(&priv->active_tx_urbs);
++
++              if (err == -ENODEV)
++                      netif_device_detach(netdev);
++              else
++                      netdev_warn(netdev, "failed tx_urb %d\n", err);
++              stats->tx_dropped++;
++      } else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS)
+               /* Slow down tx path */
+               netif_stop_queue(netdev);
+ 
+@@ -691,19 +702,6 @@ nofreecontext:
+ 
+       return NETDEV_TX_BUSY;
+ 
+-failed:
+-      can_free_echo_skb(netdev, context->echo_index);
+-
+-      usb_unanchor_urb(urb);
+-      usb_free_coherent(priv->udev, size, buf, urb->transfer_dma);
+-
+-      atomic_dec(&priv->active_tx_urbs);
+-
+-      if (err == -ENODEV)
+-              netif_device_detach(netdev);
+-      else
+-              netdev_warn(netdev, "failed tx_urb %d\n", err);
+-
+ nomembuf:
+       usb_free_urb(urb);
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index ed90639f223815e4ee04f471f5c7b19090c9d633..d77f79affa5bac84eb20c11cbfddfd818751310d 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -590,3 +590,5 @@ um-fix-uml_mconsole-stop-go.patch
 docs-sysctl-kernel-add-missing-bit-to-panic_print.patch
 openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch
 kvm-x86-mmu-do-compare-and-exchange-of-gpte-via-the-user-address.patch
+can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
+can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch