From: Marc Kleine-Budde <mkl@pengutronix.de>
To: netdev@vger.kernel.org
Cc: davem@davemloft.net, kuba@kernel.org, linux-can@vger.kernel.org,
kernel@pengutronix.de,
Vincent Mailhol <mailhol.vincent@wanadoo.fr>,
Marc Kleine-Budde <mkl@pengutronix.de>
Subject: [net 1/3] can: dev: can_restart: fix use after free bug
Date: Wed, 20 Jan 2021 13:52:00 +0100 [thread overview]
Message-ID: <20210120125202.2187358-2-mkl@pengutronix.de> (raw)
In-Reply-To: <20210120125202.2187358-1-mkl@pengutronix.de>
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
After calling netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the netif_rx_ni() in:
stats->rx_bytes += cf->len;
Reordering the lines solves the issue.
Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/dev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3486704c8a95..8b1ae023cb21 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -592,11 +592,11 @@ static void can_restart(struct net_device *dev)
cf->can_id |= CAN_ERR_RESTARTED;
- netif_rx_ni(skb);
-
stats->rx_packets++;
stats->rx_bytes += cf->len;
+ netif_rx_ni(skb);
+
restart:
netdev_dbg(dev, "restarted\n");
priv->can_stats.restarts++;
base-commit: 9c30ae8398b0813e237bde387d67a7f74ab2db2d
--
2.29.2
next prev parent reply other threads:[~2021-01-20 13:58 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-20 12:51 pull-request: can 2021-01-20 Marc Kleine-Budde
2021-01-20 12:52 ` Marc Kleine-Budde [this message]
2021-01-20 20:40 ` [net 1/3] can: dev: can_restart: fix use after free bug patchwork-bot+netdevbpf
2021-01-20 12:52 ` [net 2/3] can: vxcan: vxcan_xmit: " Marc Kleine-Budde
2021-01-20 12:52 ` [net 3/3] can: peak_usb: fix use after free bugs Marc Kleine-Budde
2021-01-20 17:19 ` pull-request: can 2021-01-20 Jakub Kicinski
2021-01-20 20:20 ` Marc Kleine-Budde
2021-01-20 20:36 ` Jakub Kicinski
2021-01-20 21:03 ` Marc Kleine-Budde
2021-01-20 20:40 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210120125202.2187358-2-mkl@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=davem@davemloft.net \
--cc=kernel@pengutronix.de \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=mailhol.vincent@wanadoo.fr \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.