* [PATCH v3 net] can: sja1000: fix use after free in ems_pcmcia_add_card()
@ 2021-11-24 14:50 Dan Carpenter
2021-11-24 17:01 ` Oliver Hartkopp
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2021-11-24 14:50 UTC (permalink / raw)
To: Wolfgang Grandegger
Cc: Marc Kleine-Budde, David S. Miller, Jakub Kicinski,
Leon Romanovsky, Markus Plessing, Oliver Hartkopp, linux-can,
netdev, kernel-janitors
If the last channel is not available then "dev" is freed. Fortunately,
we can just use "pdev->irq" instead.
Also we should check if at least one channel was set up.
Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v3: add a check for if there is a channel.
v2: fix a bug in v1. Only one channel is required but my patch returned
if any channel was unavailable.
drivers/net/can/sja1000/ems_pcmcia.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c
index e21b169c14c0..4642b6d4aaf7 100644
--- a/drivers/net/can/sja1000/ems_pcmcia.c
+++ b/drivers/net/can/sja1000/ems_pcmcia.c
@@ -234,7 +234,12 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base)
free_sja1000dev(dev);
}
- err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
+ if (!card->channels) {
+ err = -ENODEV;
+ goto failure_cleanup;
+ }
+
+ err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
DRV_NAME, card);
if (!err)
return 0;
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v3 net] can: sja1000: fix use after free in ems_pcmcia_add_card()
2021-11-24 14:50 [PATCH v3 net] can: sja1000: fix use after free in ems_pcmcia_add_card() Dan Carpenter
@ 2021-11-24 17:01 ` Oliver Hartkopp
0 siblings, 0 replies; 2+ messages in thread
From: Oliver Hartkopp @ 2021-11-24 17:01 UTC (permalink / raw)
To: Dan Carpenter, Wolfgang Grandegger
Cc: Marc Kleine-Budde, David S. Miller, Jakub Kicinski,
Leon Romanovsky, Markus Plessing, linux-can, netdev,
kernel-janitors
On 24.11.21 15:50, Dan Carpenter wrote:
> If the last channel is not available then "dev" is freed. Fortunately,
> we can just use "pdev->irq" instead.
>
> Also we should check if at least one channel was set up.
>
> Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Thanks Dan!
> ---
> v3: add a check for if there is a channel.
> v2: fix a bug in v1. Only one channel is required but my patch returned
> if any channel was unavailable.
>
> drivers/net/can/sja1000/ems_pcmcia.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c
> index e21b169c14c0..4642b6d4aaf7 100644
> --- a/drivers/net/can/sja1000/ems_pcmcia.c
> +++ b/drivers/net/can/sja1000/ems_pcmcia.c
> @@ -234,7 +234,12 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base)
> free_sja1000dev(dev);
> }
>
> - err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
> + if (!card->channels) {
> + err = -ENODEV;
> + goto failure_cleanup;
> + }
> +
> + err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
> DRV_NAME, card);
> if (!err)
> return 0;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-24 17:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-24 14:50 [PATCH v3 net] can: sja1000: fix use after free in ems_pcmcia_add_card() Dan Carpenter
2021-11-24 17:01 ` Oliver Hartkopp
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.