5.4-stable patches

added patches:
	can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch

diff --git a/queue-5.4/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch b/queue-5.4/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
new file mode 100644 (file)
index 0000000..54ef2b6
--- /dev/null
+++ b/queue-5.4/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch
@@ -0,0 +1,46 @@
+From foo@baz Tue Jul 19 01:38:27 PM CEST 2022
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Thu, 17 Mar 2022 08:57:35 +0100
+Subject: can: m_can: m_can_tx_handler(): fix use after free of skb
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream.
+
+can_put_echo_skb() will clone skb then free the skb. Move the
+can_put_echo_skb() for the m_can version 3.0.x directly before the
+start of the xmit in hardware, similar to the 3.1.x branch.
+
+Fixes: 80646733f11c ("can: m_can: update to support CAN FD features")
+Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de
+Cc: stable@vger.kernel.org
+Reported-by: Hangyu Hua <hbh25y@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+[sudip: adjust context]
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/m_can/m_can.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1443,8 +1443,6 @@ static netdev_tx_t m_can_tx_handler(stru
+                                        M_CAN_FIFO_DATA(i / 4),
+                                        *(u32 *)(cf->data + i));
+ 
+-              can_put_echo_skb(skb, dev, 0);
+-
+               if (cdev->can.ctrlmode & CAN_CTRLMODE_FD) {
+                       cccr = m_can_read(cdev, M_CAN_CCCR);
+                       cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+@@ -1461,6 +1459,9 @@ static netdev_tx_t m_can_tx_handler(stru
+                       m_can_write(cdev, M_CAN_CCCR, cccr);
+               }
+               m_can_write(cdev, M_CAN_TXBTIE, 0x1);
++
++              can_put_echo_skb(skb, dev, 0);
++
+               m_can_write(cdev, M_CAN_TXBAR, 0x1);
+               /* End of xmit function for version 3.0.x */
+       } else {

diff --git a/queue-5.4/series b/queue-5.4/series
index 7faa1551c4d4cd18d4060972844e5406253da671..7f84cd2f4d1673c6be38153d1ee651f87d0bb93d 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -68,3 +68,4 @@ tty-serial-samsung_tty-set-dma-burst_size-to-1.patch
 serial-8250-fix-return-error-code-in-serial8250_request_std_resource.patch
 serial-stm32-clear-prev-values-before-setting-rts-delays.patch
 serial-pl011-upstat_autorts-requires-.throttle-unthrottle.patch
+can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch