From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 10 Dec 2021 12:05:53 +0000 (+0100)
Subject: 4.14-stable patches
X-Git-Tag: v4.4.295~67
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b6b9664b8e4c8b5de56bbb3a89da97227e86fd6;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch
---

diff --git a/queue-4.14/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch b/queue-4.14/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch
new file mode 100644
index 00000000000..d5f7f592779
--- /dev/null
+++ b/queue-4.14/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch
@@ -0,0 +1,42 @@
+From 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Nov 2021 17:50:41 +0300
+Subject: can: sja1000: fix use after free in ems_pcmcia_add_card()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 upstream.
+
+If the last channel is not available then "dev" is freed.  Fortunately,
+we can just use "pdev->irq" instead.
+
+Also we should check if at least one channel was set up.
+
+Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card")
+Link: https://lore.kernel.org/all/20211124145041.GB13656@kili
+Cc: stable@vger.kernel.org
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/sja1000/ems_pcmcia.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/sja1000/ems_pcmcia.c
++++ b/drivers/net/can/sja1000/ems_pcmcia.c
+@@ -243,7 +243,12 @@ static int ems_pcmcia_add_card(struct pc
+ 			free_sja1000dev(dev);
+ 	}
+ 
+-	err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
++	if (!card->channels) {
++		err = -ENODEV;
++		goto failure_cleanup;
++	}
++
++	err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
+ 			  DRV_NAME, card);
+ 	if (!err)
+ 		return 0;
diff --git a/queue-4.14/series b/queue-4.14/series
index 779112f9e04..d9e28b65ce9 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -4,3 +4,4 @@ hid-add-usb_hid-dependancy-to-hid-chicony.patch
 hid-add-usb_hid-dependancy-on-some-usb-hid-drivers.patch
 hid-wacom-fix-problems-when-device-is-not-a-valid-usb-device.patch
 hid-check-for-valid-usb-device-for-many-hid-drivers.patch
+can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch