| From a55234dabe1f72cf22f9197980751d37e38ba020 Mon Sep 17 00:00:00 2001 |
| From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de> |
| Date: Fri, 11 Jan 2019 12:20:41 +0100 |
| Subject: can: flexcan: fix NULL pointer exception during bringup |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> |
| |
| commit a55234dabe1f72cf22f9197980751d37e38ba020 upstream. |
| |
| Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") |
| introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb) |
| and in the body accessed regs->mb[i] which is an out-of-bounds array |
| access that then resulted in an access to an reserved register area. |
| |
| Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add |
| provision for variable payload size") to iterate a bit differently but |
| still runs one iteration too much resulting to call |
| |
| flexcan_get_mb(priv, priv->mb_count) |
| |
| which results in a WARN_ON and then a NULL pointer exception. This |
| only affects devices compatible with "fsl,p1010-flexcan", |
| "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan", |
| "fsl,imx28-flexcan", so newer i.MX SoCs are not affected. |
| |
| Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") |
| Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> |
| Cc: linux-stable <stable@vger.kernel.org> # >= 4.20 |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| |
| --- |
| drivers/net/can/flexcan.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/net/can/flexcan.c |
| +++ b/drivers/net/can/flexcan.c |
| @@ -1004,7 +1004,7 @@ static int flexcan_chip_start(struct net |
| } |
| } else { |
| /* clear and invalidate unused mailboxes first */ |
| - for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) { |
| + for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < ARRAY_SIZE(regs->mb); i++) { |
| priv->write(FLEXCAN_MB_CODE_RX_INACTIVE, |
| ®s->mb[i].can_ctrl); |
| } |