FAILED: patch "[PATCH] can: m_can: m_can_tx_handler(): fix use after free of skb" failed to apply to 5.10-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 2e8e79c416aae1de224c0f1860f2e3350fa171f8 Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <[email protected]>
Date: Thu, 17 Mar 2022 08:57:35 +0100
Subject: [PATCH] can: m_can: m_can_tx_handler(): fix use after free of skb
can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch.
drivers/net/can/m_can/m_can.c +3 -2
@@ -1637,8 +1637,6 @@ static netdev_tx_t m_can_tx_handler(struct m_can_classdev *cdev)if (err) goto out_fail; -can_put_echo_skb (skb, dev,0 ,0 ); -if (cdev->can.ctrlmode &CAN_CTRLMODE_FD ) { cccr =m_can_read (cdev,M_CAN_CCCR ); cccr &= ~CCCR_CMR_MASK ;
@@ -1655,6 +1653,9 @@ static netdev_tx_t m_can_tx_handler(struct m_can_classdev *cdev)m_can_write (cdev,M_CAN_CCCR , cccr); }m_can_write (cdev,M_CAN_TXBTIE ,0x1 ); + +can_put_echo_skb (skb, dev,0 ,0 ); +m_can_write (cdev,M_CAN_TXBAR ,0x1 );/* End of xmit function for version 3.0.x */ }else {
Marc Kleine-Budde
maintainerQuoted 5 lines · On 01.04.2022 14:02:18, [email protected] wrote:
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
Here you are...or...it should show up here sooner or later:
https://lore.kernel.org/all/[email protected]
regards,
Marc
Quoted 47 lines
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From
2e8e79c416aae1de224c0f1860f2e3350fa171f8Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <[email protected]>
Date: Thu, 17 Mar 2022 08:57:35 +0100
Subject: [PATCH] can:m_can:m_can_tx_handler(): fix use after free of skb
can_put_echo_skb()will clone skb then free the skb. Move thecan_put_echo_skb()for them_canversion 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch.Fixes 80646733f11c ("can: m_can: update to support CAN FD features")Reported-by Hangyu Hua <[email protected]>Signed-off-by Marc Kleine-Budde <[email protected]>drivers/net/can/m_can/m_can.c +3
-2@@ -1637,8 +1637,6 @@ static netdev_tx_t m_can_tx_handler(struct m_can_classdev *cdev)if (err) goto out_fail; -can_put_echo_skb (skb, dev,0 ,0 ); -if (cdev->can.ctrlmode &CAN_CTRLMODE_FD ) { cccr =m_can_read (cdev,M_CAN_CCCR ); cccr &= ~CCCR_CMR_MASK ;@@ -1655,6 +1653,9 @@ static netdev_tx_t m_can_tx_handler(struct m_can_classdev *cdev)m_can_write (cdev,M_CAN_CCCR , cccr); }m_can_write (cdev,M_CAN_TXBTIE ,0x1 ); + +can_put_echo_skb (skb, dev,0 ,0 ); +m_can_write (cdev,M_CAN_TXBAR ,0x1 );/* End of xmit function for version 3.0.x */ }else {
Signature · 4 lines
Pengutronix e.K. | Marc Kleine-Budde | Embedded Linux | https://www.pengutronix.de | Vertretung West/Dortmund | Phone: +49-231-2826-924 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |