leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0429d6d89f
linux/drivers/net/can
History
Tong Zhang 0429d6d89f can: c_can_pci: c_can_pci_remove(): fix use-after-free 
There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: 5b92da0443 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-03-16 08:41:27 +01:00
..
c_can can: c_can_pci: c_can_pci_remove(): fix use-after-free 2021-03-16 08:41:27 +01:00
cc770 can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
dev can: dev: Move device back to init netns on owning netns delete 2021-03-16 08:40:04 +01:00
ifi_canfd can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
m_can can: tcan4x5x: tcan4x5x_init(): fix initialization - clear MRAM before entering Normal Mode 2021-03-01 11:45:15 +01:00
mscan can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
peak_canfd can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
rcar can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
sja1000 sound updates for 5.12 2021-02-21 14:21:35 -08:00
softing can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
spi can: mcp251xfd: revert "can: mcp251xfd: add BQL support" 2021-03-01 11:44:45 +01:00
usb can: kvaser_usb: Add support for USBcan Pro 4xHS 2021-03-16 08:41:26 +01:00
at91_can.c can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
flexcan.c can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate 2021-03-16 08:41:26 +01:00
grcan.c can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
janz-ican3.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
Kconfig can: kvaser_pciefd: select CONFIG_CRC32 2021-01-05 15:50:36 -08:00
kvaser_pciefd.c can: kvaser_pciefd: Always disable bus load reporting 2021-03-16 08:41:26 +01:00
led.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Makefile can: dev: move driver related infrastructure into separate subdir 2021-01-13 09:42:58 +01:00
pch_can.c can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
slcan.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
sun4i_can.c can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
ti_hecc.c can: dev: can_rx_offload_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00
vcan.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
vxcan.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
xilinx_can.c can: dev: can_get_echo_skb(): extend to return can frame length 2021-01-14 08:43:43 +01:00