| Message ID | 20211124145041.GB13656@kili (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v3,net] can: sja1000: fix use after free in ems_pcmcia_add_card() | expand |
On 24.11.21 15:50, Dan Carpenter wrote: > If the last channel is not available then "dev" is freed. Fortunately, > we can just use "pdev->irq" instead. > > Also we should check if at least one channel was set up. > > Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Tested-by: Oliver Hartkopp <socketcan@hartkopp.net> Thanks Dan! > --- > v3: add a check for if there is a channel. > v2: fix a bug in v1. Only one channel is required but my patch returned > if any channel was unavailable. > > drivers/net/can/sja1000/ems_pcmcia.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c > index e21b169c14c0..4642b6d4aaf7 100644 > --- a/drivers/net/can/sja1000/ems_pcmcia.c > +++ b/drivers/net/can/sja1000/ems_pcmcia.c > @@ -234,7 +234,12 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base) > free_sja1000dev(dev); > } > > - err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, > + if (!card->channels) { > + err = -ENODEV; > + goto failure_cleanup; > + } > + > + err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, > DRV_NAME, card); > if (!err) > return 0; >
diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c index e21b169c14c0..4642b6d4aaf7 100644 --- a/drivers/net/can/sja1000/ems_pcmcia.c +++ b/drivers/net/can/sja1000/ems_pcmcia.c @@ -234,7 +234,12 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base) free_sja1000dev(dev); } - err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, + if (!card->channels) { + err = -ENODEV; + goto failure_cleanup; + } + + err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, DRV_NAME, card); if (!err) return 0;
If the last channel is not available then "dev" is freed. Fortunately, we can just use "pdev->irq" instead. Also we should check if at least one channel was set up. Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v3: add a check for if there is a channel. v2: fix a bug in v1. Only one channel is required but my patch returned if any channel was unavailable. drivers/net/can/sja1000/ems_pcmcia.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)