mirror of
https://github.com/torvalds/linux.git
synced 2026-09-25 21:21:09 -04:00
Uwe Kleine-König
a55234dabe
Commitcbffaf7aa0("can: flexcan: Always use last mailbox for TX") introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb) and in the body accessed regs->mb[i] which is an out-of-bounds array access that then resulted in an access to an reserved register area. Later this was changed by commit0517961ccd("can: flexcan: Add provision for variable payload size") to iterate a bit differently but still runs one iteration too much resulting to call flexcan_get_mb(priv, priv->mb_count) which results in a WARN_ON and then a NULL pointer exception. This only affects devices compatible with "fsl,p1010-flexcan", "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan", "fsl,imx28-flexcan", so newer i.MX SoCs are not affected. Fixes:cbffaf7aa0("can: flexcan: Always use last mailbox for TX") Signed-off-by: Uwe Kleine-König <[email protected]> Cc: linux-stable <[email protected]> # >= 4.20 Signed-off-by: Marc Kleine-Budde <[email protected]>