From 0129c8ba63b566e17f8218495fd7ba9ad5ce0a9b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 3 Apr 2022 14:25:29 +0200 Subject: [PATCH] 4.19-stable patches added patches: can-mcba_usb-mcba_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch can-mcba_usb-properly-check-endpoint-type.patch --- ...x-double-dev_kfree_skb-in-error-path.patch | 32 +++++ ...cba_usb-properly-check-endpoint-type.patch | 121 ++++++++++++++++++ queue-4.19/series | 2 + 3 files changed, 155 insertions(+) create mode 100644 queue-4.19/can-mcba_usb-mcba_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch create mode 100644 queue-4.19/can-mcba_usb-properly-check-endpoint-type.patch diff --git a/queue-4.19/can-mcba_usb-mcba_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch b/queue-4.19/can-mcba_usb-mcba_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch new file mode 100644 index 00000000000..e506294d413 --- /dev/null +++ b/queue-4.19/can-mcba_usb-mcba_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch @@ -0,0 +1,32 @@ +From 04c9b00ba83594a29813d6b1fb8fdc93a3915174 Mon Sep 17 00:00:00 2001 +From: Hangyu Hua +Date: Fri, 11 Mar 2022 16:02:08 +0800 +Subject: can: mcba_usb: mcba_usb_start_xmit(): fix double dev_kfree_skb in error path + +From: Hangyu Hua + +commit 04c9b00ba83594a29813d6b1fb8fdc93a3915174 upstream. + +There is no need to call dev_kfree_skb() when usb_submit_urb() fails +because can_put_echo_skb() deletes original skb and +can_free_echo_skb() deletes the cloned skb. + +Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") +Link: https://lore.kernel.org/all/20220311080208.45047-1-hbh25y@gmail.com +Signed-off-by: Hangyu Hua +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/mcba_usb.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -379,7 +379,6 @@ static netdev_tx_t mcba_usb_start_xmit(s + xmit_failed: + can_free_echo_skb(priv->netdev, ctx->ndx); + mcba_usb_free_ctx(ctx); +- dev_kfree_skb(skb); + stats->tx_dropped++; + + return NETDEV_TX_OK; diff --git a/queue-4.19/can-mcba_usb-properly-check-endpoint-type.patch b/queue-4.19/can-mcba_usb-properly-check-endpoint-type.patch new file mode 100644 index 00000000000..4682ee22b86 --- /dev/null +++ b/queue-4.19/can-mcba_usb-properly-check-endpoint-type.patch @@ -0,0 +1,121 @@ +From 136bed0bfd3bc9c95c88aafff2d22ecb3a919f23 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Sun, 13 Mar 2022 13:09:03 +0300 +Subject: can: mcba_usb: properly check endpoint type + +From: Pavel Skripkin + +commit 136bed0bfd3bc9c95c88aafff2d22ecb3a919f23 upstream. + +Syzbot reported warning in usb_submit_urb() which is caused by wrong +endpoint type. We should check that in endpoint is actually present to +prevent this warning. + +Found pipes are now saved to struct mcba_priv and code uses them +directly instead of making pipes in place. + +Fail log: + +| usb 5-1: BOGUS urb xfer, pipe 3 != type 1 +| WARNING: CPU: 1 PID: 49 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 +| Modules linked in: +| CPU: 1 PID: 49 Comm: kworker/1:2 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f #0 +| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +| Workqueue: usb_hub_wq hub_event +| RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 +| ... +| Call Trace: +| +| mcba_usb_start drivers/net/can/usb/mcba_usb.c:662 [inline] +| mcba_usb_probe+0x8a3/0xc50 drivers/net/can/usb/mcba_usb.c:858 +| usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 +| call_driver_probe drivers/base/dd.c:517 [inline] + +Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") +Link: https://lore.kernel.org/all/20220313100903.10868-1-paskripkin@gmail.com +Reported-and-tested-by: syzbot+3bc1dce0cc0052d60fde@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Reviewed-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/mcba_usb.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -44,10 +44,6 @@ + #define MCBA_USB_RX_BUFF_SIZE 64 + #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg)) + +-/* MCBA endpoint numbers */ +-#define MCBA_USB_EP_IN 1 +-#define MCBA_USB_EP_OUT 1 +- + /* Microchip command id */ + #define MBCA_CMD_RECEIVE_MESSAGE 0xE3 + #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5 +@@ -95,6 +91,8 @@ struct mcba_priv { + atomic_t free_ctx_cnt; + void *rxbuf[MCBA_MAX_RX_URBS]; + dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; ++ int rx_pipe; ++ int tx_pipe; + }; + + /* CAN frame */ +@@ -283,10 +281,8 @@ static netdev_tx_t mcba_usb_xmit(struct + + memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE); + +- usb_fill_bulk_urb(urb, priv->udev, +- usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf, +- MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback, +- ctx); ++ usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE, ++ mcba_usb_write_bulk_callback, ctx); + + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + usb_anchor_urb(urb, &priv->tx_submitted); +@@ -621,7 +617,7 @@ static void mcba_usb_read_bulk_callback( + resubmit_urb: + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT), ++ priv->rx_pipe, + urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + +@@ -666,7 +662,7 @@ static int mcba_usb_start(struct mcba_pr + urb->transfer_dma = buf_dma; + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), ++ priv->rx_pipe, + buf, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; +@@ -820,6 +816,13 @@ static int mcba_usb_probe(struct usb_int + struct mcba_priv *priv; + int err = -ENOMEM; + struct usb_device *usbdev = interface_to_usbdev(intf); ++ struct usb_endpoint_descriptor *in, *out; ++ ++ err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL); ++ if (err) { ++ dev_err(&intf->dev, "Can't find endpoints\n"); ++ return err; ++ } + + netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS); + if (!netdev) { +@@ -865,6 +868,9 @@ static int mcba_usb_probe(struct usb_int + goto cleanup_free_candev; + } + ++ priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress); ++ priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress); ++ + devm_can_led_init(netdev); + + /* Start USB dev only if we have successfully registered CAN device */ diff --git a/queue-4.19/series b/queue-4.19/series index 7d548e07e1b..2a2e563c67a 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -238,3 +238,5 @@ ubifs-add-missing-iput-if-do_tmpfile-failed-in-rename-whiteout.patch ubifs-setflags-make-dirtied_ino_d-8-bytes-aligned.patch ubifs-fix-read-out-of-bounds-in-ubifs_wbuf_write_nolock.patch ubifs-rename_whiteout-correct-old_dir-size-computing.patch +can-mcba_usb-mcba_usb_start_xmit-fix-double-dev_kfree_skb-in-error-path.patch +can-mcba_usb-properly-check-endpoint-type.patch -- 2.47.3