[4/4] can: flexcan: fix NULL pointer exception during bringup
diff mbox series

Message ID 20190122132116.7074-5-mkl@pengutronix.de
State Accepted
Delegated to: David Miller
Headers show
Series
  • pull-request: can 2019-01-22
Related show

Commit Message

Marc Kleine-Budde Jan. 22, 2019, 1:21 p.m. UTC
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb)
and in the body accessed regs->mb[i] which is an out-of-bounds array
access that then resulted in an access to an reserved register area.

Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add
provision for variable payload size") to iterate a bit differently but
still runs one iteration too much resulting to call

	flexcan_get_mb(priv, priv->mb_count)

which results in a WARN_ON and then a NULL pointer exception. This
only affects devices compatible with "fsl,p1010-flexcan",
"fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan",
"fsl,imx28-flexcan", so newer i.MX SoCs are not affected.

Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: linux-stable <stable@vger.kernel.org> # >= 4.20
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/flexcan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Uwe Kleine-König Jan. 22, 2019, 1:35 p.m. UTC | #1
On Tue, Jan 22, 2019 at 02:21:16PM +0100, Marc Kleine-Budde wrote:
> From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> 
> Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
> introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb)
> and in the body accessed regs->mb[i] which is an out-of-bounds array
> access that then resulted in an access to an reserved register area.
> 
> Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add
> provision for variable payload size") to iterate a bit differently but
> still runs one iteration too much resulting to call
> 
> 	flexcan_get_mb(priv, priv->mb_count)
> 
> which results in a WARN_ON and then a NULL pointer exception. This
> only affects devices compatible with "fsl,p1010-flexcan",
> "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan",
> "fsl,imx28-flexcan", so newer i.MX SoCs are not affected.
> 
> Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> Cc: linux-stable <stable@vger.kernel.org> # >= 4.20

Given that cbffaf7aa09e was backported to v4.19.x a fix is needed there,
too. The patch looks different but I already sent a patch to
stable@vger.k.o.

Not sure if ">= 4.20" should be adapted accordingly. cbffaf7aa09e was
backported resulting in commit 24e5589791d0 which made it into v4.19.6.

Best regards
Uwe
Uwe Kleine-König Jan. 24, 2019, 7:26 a.m. UTC | #2
Hello Sasha,

On Wed, Jan 23, 2019 at 10:57:44PM +0000, Sasha Levin wrote:
> [This is an automated email]

Not sure if I only state the obvious that was just missed by your
automation.
> 
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: cbffaf7aa09e can: flexcan: Always use last mailbox for TX.
> 
> The bot has tested the following trees: v4.20.3, v4.19.16.
> 
> v4.20.3: Failed to apply! Possible dependencies:
>     0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
>     22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
>     5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
>     7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
>     de3578c198c6 ("can: flexcan: add self wakeup support")
> 
> v4.19.16: Failed to apply! Possible dependencies:
>     0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
>     22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
>     5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
>     7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
>     de3578c198c6 ("can: flexcan: add self wakeup support")
> 
> 
> How should we proceed with this patch?

When I posted the commit I also posted one that fits on top of v4.19.x.
I would expect that the same also fits on v4.20.x. If not, tell me.

Best regards
Uwe
Greg KH Jan. 28, 2019, 4:12 p.m. UTC | #3
On Thu, Jan 24, 2019 at 08:26:10AM +0100, Uwe Kleine-König wrote:
> Hello Sasha,
> 
> On Wed, Jan 23, 2019 at 10:57:44PM +0000, Sasha Levin wrote:
> > [This is an automated email]
> 
> Not sure if I only state the obvious that was just missed by your
> automation.
> > 
> > This commit has been processed because it contains a "Fixes:" tag,
> > fixing commit: cbffaf7aa09e can: flexcan: Always use last mailbox for TX.
> > 
> > The bot has tested the following trees: v4.20.3, v4.19.16.
> > 
> > v4.20.3: Failed to apply! Possible dependencies:
> >     0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
> >     22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
> >     5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
> >     7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
> >     de3578c198c6 ("can: flexcan: add self wakeup support")
> > 
> > v4.19.16: Failed to apply! Possible dependencies:
> >     0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
> >     22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
> >     5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
> >     7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
> >     de3578c198c6 ("can: flexcan: add self wakeup support")
> > 
> > 
> > How should we proceed with this patch?
> 
> When I posted the commit I also posted one that fits on top of v4.19.x.
> I would expect that the same also fits on v4.20.x. If not, tell me.

Ah, I see that now, sorry for the noise of the FAILED email...

Patch
diff mbox series

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 5f097648d12d..1c66fb2ad76b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1106,7 +1106,7 @@  static int flexcan_chip_start(struct net_device *dev)
 		}
 	} else {
 		/* clear and invalidate unused mailboxes first */
-		for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) {
+		for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) {
 			mb = flexcan_get_mb(priv, i);
 			priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
 				    &mb->can_ctrl);