From: Greg Kroah-Hartman Date: Tue, 19 Jul 2022 11:40:10 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.9.324~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4484e9c773bf6a911dc123df6d1bbecd8994b977;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch --- diff --git a/queue-4.19/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch b/queue-4.19/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch new file mode 100644 index 00000000000..d56cb9e482a --- /dev/null +++ b/queue-4.19/can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Jul 19 01:38:52 PM CEST 2022 +From: Marc Kleine-Budde +Date: Thu, 17 Mar 2022 08:57:35 +0100 +Subject: can: m_can: m_can_tx_handler(): fix use after free of skb + +From: Marc Kleine-Budde + +commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream. + +can_put_echo_skb() will clone skb then free the skb. Move the +can_put_echo_skb() for the m_can version 3.0.x directly before the +start of the xmit in hardware, similar to the 3.1.x branch. + +Fixes: 80646733f11c ("can: m_can: update to support CAN FD features") +Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de +Cc: stable@vger.kernel.org +Reported-by: Hangyu Hua +Signed-off-by: Marc Kleine-Budde +[sudip: adjust context] +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/m_can/m_can.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1438,8 +1438,6 @@ static netdev_tx_t m_can_start_xmit(stru + M_CAN_FIFO_DATA(i / 4), + *(u32 *)(cf->data + i)); + +- can_put_echo_skb(skb, dev, 0); +- + if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { + cccr = m_can_read(priv, M_CAN_CCCR); + cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT); +@@ -1456,6 +1454,9 @@ static netdev_tx_t m_can_start_xmit(stru + m_can_write(priv, M_CAN_CCCR, cccr); + } + m_can_write(priv, M_CAN_TXBTIE, 0x1); ++ ++ can_put_echo_skb(skb, dev, 0); ++ + m_can_write(priv, M_CAN_TXBAR, 0x1); + /* End of xmit function for version 3.0.x */ + } else { diff --git a/queue-4.19/series b/queue-4.19/series index f30941d190e..7429af7ca38 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -45,3 +45,4 @@ tty-serial-samsung_tty-set-dma-burst_size-to-1.patch serial-8250-fix-return-error-code-in-serial8250_request_std_resource.patch serial-stm32-clear-prev-values-before-setting-rts-delays.patch serial-pl011-upstat_autorts-requires-.throttle-unthrottle.patch +can-m_can-m_can_tx_handler-fix-use-after-free-of-skb.patch