netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* pull-request: can 2013-07-19
@ 2013-07-19 13:17 Marc Kleine-Budde
  2013-07-19 13:17 ` [PATCH 1/2] net: can: esd_usb2: check index of array before accessing Marc Kleine-Budde
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2013-07-19 13:17 UTC (permalink / raw)
  To: netdev; +Cc: kernel, linux-can, davem

Hello David,

here are two fixes for the v3.11 release cycle:

Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
sanity checking to the data coming from the USB CAN adapter before using it.
Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
in the error handling of the USB 8dev's usb_8dev_start() function.

regards,
Marc
---

The following changes since commit ecb2cf1a6b63825a258ff4fe0d7f3070fbe4676b:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net (2013-07-18 20:08:47 -0700)

are available in the git repository at:


  git://gitorious.org/linux-can/linux-can.git fixes-for-3.11

for you to fetch changes up to 7671986839f9207f8d76e8ef92b2d3f263a794cc:

  can: usb_8dev: fix urb leak on failure path in usb_8dev_start() (2013-07-19 14:55:14 +0200)

----------------------------------------------------------------
Alexey Khoroshilov (1):
      can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

Maximilian Schneider (1):
      net: can: esd_usb2: check index of array before accessing

 drivers/net/can/usb/esd_usb2.c | 10 ++++++++++
 drivers/net/can/usb/usb_8dev.c |  1 +
 2 files changed, 11 insertions(+)

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [PATCH 1/2] net: can: esd_usb2: check index of array before accessing
  2013-07-19 13:17 pull-request: can 2013-07-19 Marc Kleine-Budde
@ 2013-07-19 13:17 ` Marc Kleine-Budde
  2013-07-19 13:17 ` [PATCH 2/2] can: usb_8dev: fix urb leak on failure path in usb_8dev_start() Marc Kleine-Budde
  2013-07-21  0:01 ` pull-request: can 2013-07-19 David Miller
  2 siblings, 0 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2013-07-19 13:17 UTC (permalink / raw)
  To: netdev; +Cc: kernel, linux-can, davem, Maximilian Schneider, Marc Kleine-Budde

From: Maximilian Schneider <max@schneidersoft.net>

The esd_usb2_read_bulk_callback() function is parsing the data that comes from
the USB CAN adapter. One datum is used as an index to access the dev->nets[]
array. This patch adds the missing bounds checking.

Acked-by: Matthias Fuchs <matthias.fuchs@esd.eu>
Signed-off-by: Maximilian Schneider <max@schneidersoft.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/esd_usb2.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 6aa7b32..ac6177d 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -412,10 +412,20 @@ static void esd_usb2_read_bulk_callback(struct urb *urb)
 
 		switch (msg->msg.hdr.cmd) {
 		case CMD_CAN_RX:
+			if (msg->msg.rx.net >= dev->net_count) {
+				dev_err(dev->udev->dev.parent, "format error\n");
+				break;
+			}
+
 			esd_usb2_rx_can_msg(dev->nets[msg->msg.rx.net], msg);
 			break;
 
 		case CMD_CAN_TX:
+			if (msg->msg.txdone.net >= dev->net_count) {
+				dev_err(dev->udev->dev.parent, "format error\n");
+				break;
+			}
+
 			esd_usb2_tx_done_msg(dev->nets[msg->msg.txdone.net],
 					     msg);
 			break;
-- 
1.8.3.1

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [PATCH 2/2] can: usb_8dev: fix urb leak on failure path in usb_8dev_start()
  2013-07-19 13:17 pull-request: can 2013-07-19 Marc Kleine-Budde
  2013-07-19 13:17 ` [PATCH 1/2] net: can: esd_usb2: check index of array before accessing Marc Kleine-Budde
@ 2013-07-19 13:17 ` Marc Kleine-Budde
  2013-07-21  0:01 ` pull-request: can 2013-07-19 David Miller
  2 siblings, 0 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2013-07-19 13:17 UTC (permalink / raw)
  To: netdev; +Cc: kernel, linux-can, davem, Alexey Khoroshilov, Marc Kleine-Budde

From: Alexey Khoroshilov <khoroshilov@ispras.ru>

If usb_8dev_start() fails to submit urb,
it unanchors the urb but forgets to free it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/usb_8dev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388e..8becd3d 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 			usb_unanchor_urb(urb);
 			usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
 					  urb->transfer_dma);
+			usb_free_urb(urb);
 			break;
 		}
 
-- 
1.8.3.1

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: pull-request: can 2013-07-19
  2013-07-19 13:17 pull-request: can 2013-07-19 Marc Kleine-Budde
  2013-07-19 13:17 ` [PATCH 1/2] net: can: esd_usb2: check index of array before accessing Marc Kleine-Budde
  2013-07-19 13:17 ` [PATCH 2/2] can: usb_8dev: fix urb leak on failure path in usb_8dev_start() Marc Kleine-Budde
@ 2013-07-21  0:01 ` David Miller
  2 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2013-07-21  0:01 UTC (permalink / raw)
  To: mkl; +Cc: netdev, kernel, linux-can

From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Fri, 19 Jul 2013 15:17:47 +0200

> here are two fixes for the v3.11 release cycle:
> 
> Maximilian Schneider contributes a patch for the esd_usb2 CAN driver. It adds
> sanity checking to the data coming from the USB CAN adapter before using it.
> Alexey Khoroshilov from the Linux Driver Verification project fixes an urb leak
> in the error handling of the USB 8dev's usb_8dev_start() function.

Pulled, thanks Marc.

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2013-07-21  0:01 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-19 13:17 pull-request: can 2013-07-19 Marc Kleine-Budde
2013-07-19 13:17 ` [PATCH 1/2] net: can: esd_usb2: check index of array before accessing Marc Kleine-Budde
2013-07-19 13:17 ` [PATCH 2/2] can: usb_8dev: fix urb leak on failure path in usb_8dev_start() Marc Kleine-Budde
2013-07-21  0:01 ` pull-request: can 2013-07-19 David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).