* [PATCH] can: etas_es58x: fix null pointer dereference when handling error frames
@ 2021-04-13 11:42 Vincent Mailhol
2021-04-13 12:00 ` Marc Kleine-Budde
0 siblings, 1 reply; 2+ messages in thread
From: Vincent Mailhol @ 2021-04-13 11:42 UTC (permalink / raw)
To: Marc Kleine-Budde, linux-can
Cc: linux-kernel, netdev, Arunachalam Santhanam, David S . Miller,
Jakub Kicinski, Vincent Mailhol
During the handling of CAN bus errors, a CAN error SKB is allocated
using alloc_can_err_skb(). Even if the allocation of the SKB fails,
the function continues in order to do the stats handling.
All access to the can_frame pointer (cf) should be guarded by an if
statement:
if (cf)
However, the increment of the rx_bytes stats:
netdev->stats.rx_bytes += cf->can_dlc;
dereferences the cf pointer and was not guarded by an if condition
leading to a NULL pointer dereference if the can_err_skb() function
failed.
Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the
length of any CAN error frames) solves this NULL pointer dereference.
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
---
Hi Marc,
I am really sorry, but I was just notified about this issue litteraly
a few minutes after you send the pull request to net-next.
I am not sure how to proceed. You might either cancel the pull request
and squash this to 8537257874e9 ("can: etas_es58x: add core support
for ETAS ES58X CAN USB interfaces") or send it as a separate patch.
Please let me know if you need me to do anything.
Yours sincerely,
Vincent Mailhol
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index 7222b3b6ca46..57e5f94468e9 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -856,7 +856,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error,
* consistency.
*/
netdev->stats.rx_packets++;
- netdev->stats.rx_bytes += cf->can_dlc;
+ netdev->stats.rx_bytes += CAN_ERR_DLC;
if (cf) {
if (cf->data[1])
--
2.26.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] can: etas_es58x: fix null pointer dereference when handling error frames
2021-04-13 11:42 [PATCH] can: etas_es58x: fix null pointer dereference when handling error frames Vincent Mailhol
@ 2021-04-13 12:00 ` Marc Kleine-Budde
0 siblings, 0 replies; 2+ messages in thread
From: Marc Kleine-Budde @ 2021-04-13 12:00 UTC (permalink / raw)
To: Vincent Mailhol
Cc: linux-can, linux-kernel, netdev, Arunachalam Santhanam,
David S . Miller, Jakub Kicinski
[-- Attachment #1: Type: text/plain, Size: 1758 bytes --]
On 13.04.2021 20:42:42, Vincent Mailhol wrote:
> During the handling of CAN bus errors, a CAN error SKB is allocated
> using alloc_can_err_skb(). Even if the allocation of the SKB fails,
> the function continues in order to do the stats handling.
>
> All access to the can_frame pointer (cf) should be guarded by an if
> statement:
> if (cf)
>
> However, the increment of the rx_bytes stats:
> netdev->stats.rx_bytes += cf->can_dlc;
> dereferences the cf pointer and was not guarded by an if condition
> leading to a NULL pointer dereference if the can_err_skb() function
> failed.
>
> Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the
> length of any CAN error frames) solves this NULL pointer dereference.
>
> Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
> Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
> Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
> ---
> Hi Marc,
>
> I am really sorry, but I was just notified about this issue litteraly
> a few minutes after you send the pull request to net-next.
:D
> I am not sure how to proceed. You might either cancel the pull request
> and squash this to 8537257874e9 ("can: etas_es58x: add core support
> for ETAS ES58X CAN USB interfaces") or send it as a separate patch.
>
> Please let me know if you need me to do anything.
I'll send a follow-up pull request tomorrow.
regards,
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung West/Dortmund | Phone: +49-231-2826-924 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-04-13 12:00 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-13 11:42 [PATCH] can: etas_es58x: fix null pointer dereference when handling error frames Vincent Mailhol
2021-04-13 12:00 ` Marc Kleine-Budde
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).