lkml.org 
[lkml]   [2018]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 081/105] can: cc770: Fix use after free in cc770_tx_interrupt()
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andri Yngvason <andri.yngvason@marel.com>

    commit 9ffd7503944ec7c0ef41c3245d1306c221aef2be upstream.

    This fixes use after free introduced by the last cc770 patch.

    Signed-off-by: Andri Yngvason <andri.yngvason@marel.com>
    Fixes: 746201235b3f ("can: cc770: Fix queue stall & dropped RTR reply")
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/can/cc770/cc770.c | 5 ++---
    1 file changed, 2 insertions(+), 3 deletions(-)

    --- a/drivers/net/can/cc770/cc770.c
    +++ b/drivers/net/can/cc770/cc770.c
    @@ -706,13 +706,12 @@ static void cc770_tx_interrupt(struct ne
    return;
    }

    - can_put_echo_skb(priv->tx_skb, dev, 0);
    - can_get_echo_skb(dev, 0);
    -
    cf = (struct can_frame *)priv->tx_skb->data;
    stats->tx_bytes += cf->can_dlc;
    stats->tx_packets++;

    + can_put_echo_skb(priv->tx_skb, dev, 0);
    + can_get_echo_skb(dev, 0);
    priv->tx_skb = NULL;

    netif_wake_queue(dev);

    \
     
     \ /
      Last update: 2018-03-27 18:44    [W:4.038 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site