From: Greg Kroah-Hartman Date: Tue, 5 Apr 2022 05:27:58 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.17.2~37 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e59b30fd017c7d207c48af289a64458b8d42f693;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch --- diff --git a/queue-5.10/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch b/queue-5.10/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch new file mode 100644 index 00000000000..052a0d0fa78 --- /dev/null +++ b/queue-5.10/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch @@ -0,0 +1,44 @@ +From 2e8e79c416aae1de224c0f1860f2e3350fa171f8 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Thu, 17 Mar 2022 08:57:35 +0100 +Subject: can: m_can: m_can_tx_handler(): fix use after free of skb + +From: Marc Kleine-Budde + +commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream. + +can_put_echo_skb() will clone skb then free the skb. Move the +can_put_echo_skb() for the m_can version 3.0.x directly before the +start of the xmit in hardware, similar to the 3.1.x branch. + +Fixes: 80646733f11c ("can: m_can: update to support CAN FD features") +Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de +Cc: stable@vger.kernel.org +Reported-by: Hangyu Hua +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/m_can/m_can.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1491,8 +1491,6 @@ static netdev_tx_t m_can_tx_handler(stru + M_CAN_FIFO_DATA(i / 4), + *(u32 *)(cf->data + i)); + +- can_put_echo_skb(skb, dev, 0); +- + if (cdev->can.ctrlmode & CAN_CTRLMODE_FD) { + cccr = m_can_read(cdev, M_CAN_CCCR); + cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT); +@@ -1509,6 +1507,9 @@ static netdev_tx_t m_can_tx_handler(stru + m_can_write(cdev, M_CAN_CCCR, cccr); + } + m_can_write(cdev, M_CAN_TXBTIE, 0x1); ++ ++ can_put_echo_skb(skb, dev, 0); ++ + m_can_write(cdev, M_CAN_TXBAR, 0x1); + /* End of xmit function for version 3.0.x */ + } else { diff --git a/queue-5.10/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch b/queue-5.10/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch new file mode 100644 index 00000000000..75e634895b3 --- /dev/null +++ b/queue-5.10/can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch @@ -0,0 +1,69 @@ +From 3d3925ff6433f98992685a9679613a2cc97f3ce2 Mon Sep 17 00:00:00 2001 +From: Hangyu Hua +Date: Fri, 11 Mar 2022 16:06:14 +0800 +Subject: can: usb_8dev: usb_8dev_start_xmit(): fix double dev_kfree_skb() in error path + +From: Hangyu Hua + +commit 3d3925ff6433f98992685a9679613a2cc97f3ce2 upstream. + +There is no need to call dev_kfree_skb() when usb_submit_urb() fails +because can_put_echo_skb() deletes original skb and +can_free_echo_skb() deletes the cloned skb. + +Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") +Link: https://lore.kernel.org/all/20220311080614.45229-1-hbh25y@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Hangyu Hua +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/usb_8dev.c | 30 ++++++++++++++---------------- + 1 file changed, 14 insertions(+), 16 deletions(-) + +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -670,9 +670,20 @@ static netdev_tx_t usb_8dev_start_xmit(s + atomic_inc(&priv->active_tx_urbs); + + err = usb_submit_urb(urb, GFP_ATOMIC); +- if (unlikely(err)) +- goto failed; +- else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS) ++ if (unlikely(err)) { ++ can_free_echo_skb(netdev, context->echo_index); ++ ++ usb_unanchor_urb(urb); ++ usb_free_coherent(priv->udev, size, buf, urb->transfer_dma); ++ ++ atomic_dec(&priv->active_tx_urbs); ++ ++ if (err == -ENODEV) ++ netif_device_detach(netdev); ++ else ++ netdev_warn(netdev, "failed tx_urb %d\n", err); ++ stats->tx_dropped++; ++ } else if (atomic_read(&priv->active_tx_urbs) >= MAX_TX_URBS) + /* Slow down tx path */ + netif_stop_queue(netdev); + +@@ -691,19 +702,6 @@ nofreecontext: + + return NETDEV_TX_BUSY; + +-failed: +- can_free_echo_skb(netdev, context->echo_index); +- +- usb_unanchor_urb(urb); +- usb_free_coherent(priv->udev, size, buf, urb->transfer_dma); +- +- atomic_dec(&priv->active_tx_urbs); +- +- if (err == -ENODEV) +- netif_device_detach(netdev); +- else +- netdev_warn(netdev, "failed tx_urb %d\n", err); +- + nomembuf: + usb_free_urb(urb); + diff --git a/queue-5.10/series b/queue-5.10/series index ed90639f223..d77f79affa5 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -590,3 +590,5 @@ um-fix-uml_mconsole-stop-go.patch docs-sysctl-kernel-add-missing-bit-to-panic_print.patch openvswitch-fixed-nd-target-mask-field-in-the-flow-dump.patch kvm-x86-mmu-do-compare-and-exchange-of-gpte-via-the-user-address.patch +can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch +can-usb_8dev-usb_8dev_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch