pull-request: can 2013-07-19

pull-request: can 2013-07-19

[Marc Kleine-Budde]

Hello David,

here are two fixes for the v3.11 release cycle:

Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
sanity checking to the data coming from the USB CAN adapter before using it.
Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
in the error handling of the USB 8dev's usb_8dev_start() function.

regards,
Marc
---

The following changes since commit ecb2cf1a6b63825a258ff4fe0d7f3070fbe4676b:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-07-18 20:08:47 -0700)

are available in the git repository at:


  git://gitorious.org/linux-can/linux-can.git fixes-for-3.11

for you to fetch changes up to 7671986839f9207f8d76e8ef92b2d3f263a794cc:

  can: usb_8dev: fix urb leak on failure path in usb_8dev_start() (2013-07-19 14:55:14 +0200)

----------------------------------------------------------------
Alexey Khoroshilov (1):
      can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

Maximilian Schneider (1):
      net: can: esd_usb2: check index of array before accessing

 drivers/net/can/usb/esd_usb2.c | 10 ++++++++++
 drivers/net/can/usb/usb_8dev.c |  1 +
 2 files changed, 11 insertions(+)

[PATCH 1/2] net: can: esd_usb2: check index of array before accessing

[Marc Kleine-Budde]

From: Maximilian Schneider <max@schneidersoft.net>

The esd_usb2_read_bulk_callback() function is parsing the data that comes from
the USB CAN adapter. One datum is used as an index to access the dev->nets[]
array. This patch adds the missing bounds checking.

Acked-by: Matthias Fuchs <matthias.fuchs@esd.eu>
Signed-off-by: Maximilian Schneider <max@schneidersoft.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/esd_usb2.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b32..ac6177d 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
 
 		switch (msg->msg.hdr.cmd) {
 		case CMD_CAN_RX:
+			if (msg->msg.rx.net >= dev->net_count) {
+				dev_err(dev->udev->dev.parent, "format error\n");
+				break;
+			}
+
 			esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
 			break;
 
 		case CMD_CAN_TX:
+			if (msg->msg.txdone.net >= dev->net_count) {
+				dev_err(dev->udev->dev.parent, "format error\n");
+				break;
+			}
+
 			esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
 					     msg);
 			break;
-- 
1.8.3.1

[PATCH 2/2] can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

[Marc Kleine-Budde]

From: Alexey Khoroshilov <khoroshilov@ispras.ru>

If usb_8dev_start() fails to submit urb,
it unanchors the urb but forgets to free it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/usb_8dev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388e..8becd3d 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 			usb_unanchor_urb(urb);
 			usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
 					  urb->transfer_dma);
+			usb_free_urb(urb);
 			break;
 		}
 
-- 
1.8.3.1

Re: pull-request: can 2013-07-19

[David Miller]

From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Fri, 19 Jul 2013 15:17:47 +0200

> here are two fixes for the v3.11 release cycle:
> 
> Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
> sanity checking to the data coming from the USB CAN adapter before using it.
> Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
> in the error handling of the USB 8dev's usb_8dev_start() function.

Pulled, thanks Marc.