From c3e8627ede4b7fcc5f51df2a76554c17d54e10f0 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 10 Dec 2021 13:05:38 +0100 Subject: [PATCH] 4.9-stable patches added patches: can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch --- ...se-after-free-in-ems_pcmcia_add_card.patch | 42 +++++++++++++++++++ queue-4.9/series | 1 + 2 files changed, 43 insertions(+) create mode 100644 queue-4.9/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch diff --git a/queue-4.9/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch b/queue-4.9/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch new file mode 100644 index 00000000000..d5f7f592779 --- /dev/null +++ b/queue-4.9/can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch @@ -0,0 +1,42 @@ +From 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 24 Nov 2021 17:50:41 +0300 +Subject: can: sja1000: fix use after free in ems_pcmcia_add_card() + +From: Dan Carpenter + +commit 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 upstream. + +If the last channel is not available then "dev" is freed. Fortunately, +we can just use "pdev->irq" instead. + +Also we should check if at least one channel was set up. + +Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card") +Link: https://lore.kernel.org/all/20211124145041.GB13656@kili +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Acked-by: Oliver Hartkopp +Tested-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/sja1000/ems_pcmcia.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/can/sja1000/ems_pcmcia.c ++++ b/drivers/net/can/sja1000/ems_pcmcia.c +@@ -243,7 +243,12 @@ static int ems_pcmcia_add_card(struct pc + free_sja1000dev(dev); + } + +- err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, ++ if (!card->channels) { ++ err = -ENODEV; ++ goto failure_cleanup; ++ } ++ ++ err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, + DRV_NAME, card); + if (!err) + return 0; diff --git a/queue-4.9/series b/queue-4.9/series index 33eeaee0815..6f171eecbbb 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -5,3 +5,4 @@ hid-add-usb_hid-dependancy-to-hid-chicony.patch hid-add-usb_hid-dependancy-on-some-usb-hid-drivers.patch hid-wacom-fix-problems-when-device-is-not-a-valid-usb-device.patch hid-check-for-valid-usb-device-for-many-hid-drivers.patch +can-sja1000-fix-use-after-free-in-ems_pcmcia_add_card.patch -- 2.47.2