From: Sasha Levin Date: Mon, 25 Jan 2021 03:21:30 +0000 (-0500) Subject: Fixes for 4.9 X-Git-Tag: v4.19.171~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7c184a1d206c17fc9b92bf9772b8ed68e1b00d52;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/can-dev-can_restart-fix-use-after-free-bug.patch b/queue-4.9/can-dev-can_restart-fix-use-after-free-bug.patch new file mode 100644 index 00000000000..93adeae47c7 --- /dev/null +++ b/queue-4.9/can-dev-can_restart-fix-use-after-free-bug.patch @@ -0,0 +1,46 @@ +From 19aa0b41232476f371e0c623fc644fe02f197149 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 20:41:35 +0900 +Subject: can: dev: can_restart: fix use after free bug + +From: Vincent Mailhol + +[ Upstream commit 03f16c5075b22c8902d2af739969e878b0879c94 ] + +After calling netif_rx_ni(skb), dereferencing skb is unsafe. +Especially, the can_frame cf which aliases skb memory is accessed +after the netif_rx_ni() in: + stats->rx_bytes += cf->len; + +Reordering the lines solves the issue. + +Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") +Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index c7508d9a4c6fb..164078609f98e 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -555,11 +555,11 @@ static void can_restart(struct net_device *dev) + } + cf->can_id |= CAN_ERR_RESTARTED; + +- netif_rx_ni(skb); +- + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; + ++ netif_rx_ni(skb); ++ + restart: + netdev_dbg(dev, "restarted\n"); + priv->can_stats.restarts++; +-- +2.27.0 + diff --git a/queue-4.9/i2c-octeon-check-correct-size-of-maximum-recv_len-pa.patch b/queue-4.9/i2c-octeon-check-correct-size-of-maximum-recv_len-pa.patch new file mode 100644 index 00000000000..039077bebe2 --- /dev/null +++ b/queue-4.9/i2c-octeon-check-correct-size-of-maximum-recv_len-pa.patch @@ -0,0 +1,37 @@ +From d5f1d167baad0d412bd055f96c4b401cb66db13d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Jan 2021 13:43:08 +0100 +Subject: i2c: octeon: check correct size of maximum RECV_LEN packet + +From: Wolfram Sang + +[ Upstream commit 1b2cfa2d1dbdcc3b6dba1ecb7026a537a1d7277f ] + +I2C_SMBUS_BLOCK_MAX defines already the maximum number as defined in the +SMBus 2.0 specs. No reason to add one to it. + +Fixes: 886f6f8337dd ("i2c: octeon: Support I2C_M_RECV_LEN") +Signed-off-by: Wolfram Sang +Reviewed-by: Robert Richter +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-octeon-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-octeon-core.c b/drivers/i2c/busses/i2c-octeon-core.c +index 5e63b17f935d5..e5ad3f9cd372f 100644 +--- a/drivers/i2c/busses/i2c-octeon-core.c ++++ b/drivers/i2c/busses/i2c-octeon-core.c +@@ -383,7 +383,7 @@ static int octeon_i2c_read(struct octeon_i2c *i2c, int target, + + data[i] = octeon_i2c_data_read(i2c); + if (recv_len && i == 0) { +- if (data[i] > I2C_SMBUS_BLOCK_MAX + 1) ++ if (data[i] > I2C_SMBUS_BLOCK_MAX) + return -EPROTO; + length += data[i]; + } +-- +2.27.0 + diff --git a/queue-4.9/series b/queue-4.9/series index 1490fe3cb01..3d097e1baa8 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -6,3 +6,5 @@ asoc-intel-haswell-add-missing-pm_ops.patch scsi-ufs-correct-the-lun-used-in-eh_device_reset_han.patch drm-nouveau-bios-fix-issue-shadowing-expansion-roms.patch drm-nouveau-i2c-gm200-increase-width-of-aux-semaphor.patch +i2c-octeon-check-correct-size-of-maximum-recv_len-pa.patch +can-dev-can_restart-fix-use-after-free-bug.patch