From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 770C2C282C8 for ; Mon, 28 Jan 2019 17:09:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4467F21741 for ; Mon, 28 Jan 2019 17:09:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548695357; bh=5hbJWYKpdWhNnhFkjWVucu+ckjBKLZy59gwhapxFGiI=; h=Subject:To:Cc:From:Date:List-ID:From; b=rl/BOaDzYuTUd5PSg/cqwsQy7IOpupXa3DpdmxrDBHuR0Y2em01jH9HzwSsOvZ4X6 oDNK5MvoQ9PO8U6xNVpWo6s+29kqnyazfg3LDrNhkxs3hsajBxdGxiTKCfV9/uAOGL pU6JyGqLqRpr0xYGhSYjq028ddWgks6o5crmWVi8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730546AbfA1RJQ (ORCPT ); Mon, 28 Jan 2019 12:09:16 -0500 Received: from new1-smtp.messagingengine.com ([66.111.4.221]:40035 "EHLO new1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732982AbfA1QLi (ORCPT ); Mon, 28 Jan 2019 11:11:38 -0500 Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailnew.nyi.internal (Postfix) with ESMTP id 7F0B2DD13; Mon, 28 Jan 2019 11:11:37 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Mon, 28 Jan 2019 11:11:37 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=DSqN0c H8tUCPt3EtFiDP1RMjis2hxTyLxxO78eV7RRU=; b=NkbVKqWnPAf5GI8OozFzpc P3RW55U/WjRXisqS9/NwUrUmwT9LP1F6XZbDru78IS1gpcbO0+g2zm8tsTtbs7MF 7bGjCmn1TjZKMp9eBu1DHlhm2MawZbDWD8u+VM6i+bHlNIqblcqiE+NL8crVZQBT 1LpF8A+MLfhg+zs+p30eX4iV1Mz6F28tM0H6mb4QOd7K8LiVV7dfXt5cM9ReLXbJ Ll3gXuAdhah3G9GNVA+6VefLFHxlf5e7Sti/E52m0pIVh5L2Ay/UahtjhAtHcRSN DIfuJGlMAnLCWsXX10Y9095wTDuiJNdoE6uqHCWPCv5HgqaPTmGcIisDFBn29CZQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedtledrjedtgdeklecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfhuthenuceurghilhhouhhtmecufedt tdenucgoufhprghmkfhpucdlfedttddmnecujfgurhepuffvhfffkfggtgfgsehtkeertd dttdejnecuhfhrohhmpeeoghhrvghgkhhhsehlihhnuhigfhhouhhnuggrthhiohhnrdho rhhgqeenucfkphepkeefrdekiedrkeelrddutdejnecurfgrrhgrmhepmhgrihhlfhhroh hmpehgrhgvgheskhhrohgrhhdrtghomhenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: from localhost (5356596b.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) by mail.messagingengine.com (Postfix) with ESMTPA id CD76EE4068; Mon, 28 Jan 2019 11:11:36 -0500 (EST) Subject: FAILED: patch "[PATCH] can: flexcan: fix NULL pointer exception during bringup" failed to apply to 4.19-stable tree To: u.kleine-koenig@pengutronix.de, mkl@pengutronix.de, stable@vger.kernel.org Cc: From: Date: Mon, 28 Jan 2019 17:11:35 +0100 Message-ID: <1548691895159128@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 4.19-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From a55234dabe1f72cf22f9197980751d37e38ba020 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= Date: Fri, 11 Jan 2019 12:20:41 +0100 Subject: [PATCH] can: flexcan: fix NULL pointer exception during bringup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb) and in the body accessed regs->mb[i] which is an out-of-bounds array access that then resulted in an access to an reserved register area. Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add provision for variable payload size") to iterate a bit differently but still runs one iteration too much resulting to call flexcan_get_mb(priv, priv->mb_count) which results in a WARN_ON and then a NULL pointer exception. This only affects devices compatible with "fsl,p1010-flexcan", "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan", "fsl,imx28-flexcan", so newer i.MX SoCs are not affected. Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") Signed-off-by: Uwe Kleine-König Cc: linux-stable # >= 4.20 Signed-off-by: Marc Kleine-Budde diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c index 5f097648d12d..1c66fb2ad76b 100644 --- a/drivers/net/can/flexcan.c +++ b/drivers/net/can/flexcan.c @@ -1106,7 +1106,7 @@ static int flexcan_chip_start(struct net_device *dev) } } else { /* clear and invalidate unused mailboxes first */ - for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) { + for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) { mb = flexcan_get_mb(priv, i); priv->write(FLEXCAN_MB_CODE_RX_INACTIVE, &mb->can_ctrl);