* pull-request: can-next 2021-04-14
@ 2021-04-14 20:03 Marc Kleine-Budde
2021-04-14 20:03 ` [net-next] can: etas_es58x: fix null pointer dereference when handling error frames Marc Kleine-Budde
2021-04-14 21:40 ` pull-request: can-next 2021-04-14 patchwork-bot+netdevbpf
0 siblings, 2 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-04-14 20:03 UTC (permalink / raw)
To: netdev; +Cc: davem, kuba, linux-can, kernel
Hello Jakub, hello David,
this is a pull request of a single patch for net-next/master.
Vincent Mailhol's patch fixes a NULL pointer dereference when handling
error frames in the etas_es58x driver, which has been added in the
previous PR.
regards,
Marc
---
The following changes since commit 5871d0c6b8ea805916c3135d0c53b095315bc674:
ionic: return -EFAULT if copy_to_user() fails (2021-04-13 15:08:18 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next.git tags/linux-can-next-for-5.13-20210414
for you to fetch changes up to e2b1e4b532abdd39bfb7313146153815e370d60c:
can: etas_es58x: fix null pointer dereference when handling error frames (2021-04-14 09:32:12 +0200)
----------------------------------------------------------------
linux-can-next-for-5.13-20210414
----------------------------------------------------------------
Vincent Mailhol (1):
can: etas_es58x: fix null pointer dereference when handling error frames
drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
^ permalink raw reply [flat|nested] 4+ messages in thread
* [net-next] can: etas_es58x: fix null pointer dereference when handling error frames
2021-04-14 20:03 pull-request: can-next 2021-04-14 Marc Kleine-Budde
@ 2021-04-14 20:03 ` Marc Kleine-Budde
2021-04-14 21:40 ` patchwork-bot+netdevbpf
2021-04-14 21:40 ` pull-request: can-next 2021-04-14 patchwork-bot+netdevbpf
1 sibling, 1 reply; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-04-14 20:03 UTC (permalink / raw)
To: netdev
Cc: davem, kuba, linux-can, kernel, Vincent Mailhol,
Arunachalam Santhanam, Marc Kleine-Budde
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
During the handling of CAN bus errors, a CAN error SKB is allocated
using alloc_can_err_skb(). Even if the allocation of the SKB fails,
the function continues in order to do the stats handling.
All access to the can_frame pointer (cf) should be guarded by an if
statement:
if (cf)
However, the increment of the rx_bytes stats:
netdev->stats.rx_bytes += cf->can_dlc;
dereferences the cf pointer and was not guarded by an if condition
leading to a NULL pointer dereference if the can_err_skb() function
failed.
Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the
length of any CAN error frames) solves this NULL pointer dereference.
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Link: https://lore.kernel.org/r/20210413114242.2760-1-mailhol.vincent@wanadoo.fr
Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index 7222b3b6ca46..57e5f94468e9 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -856,7 +856,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error,
* consistency.
*/
netdev->stats.rx_packets++;
- netdev->stats.rx_bytes += cf->can_dlc;
+ netdev->stats.rx_bytes += CAN_ERR_DLC;
if (cf) {
if (cf->data[1])
base-commit: 5871d0c6b8ea805916c3135d0c53b095315bc674
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [net-next] can: etas_es58x: fix null pointer dereference when handling error frames
2021-04-14 20:03 ` [net-next] can: etas_es58x: fix null pointer dereference when handling error frames Marc Kleine-Budde
@ 2021-04-14 21:40 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-04-14 21:40 UTC (permalink / raw)
To: Marc Kleine-Budde
Cc: netdev, davem, kuba, linux-can, kernel, mailhol.vincent,
arunachalam.santhanam
Hello:
This patch was applied to netdev/net-next.git (refs/heads/master):
On Wed, 14 Apr 2021 22:03:52 +0200 you wrote:
> From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
>
> During the handling of CAN bus errors, a CAN error SKB is allocated
> using alloc_can_err_skb(). Even if the allocation of the SKB fails,
> the function continues in order to do the stats handling.
>
> All access to the can_frame pointer (cf) should be guarded by an if
> statement:
> if (cf)
>
> [...]
Here is the summary with links:
- [net-next] can: etas_es58x: fix null pointer dereference when handling error frames
https://git.kernel.org/netdev/net-next/c/e2b1e4b532ab
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: pull-request: can-next 2021-04-14
2021-04-14 20:03 pull-request: can-next 2021-04-14 Marc Kleine-Budde
2021-04-14 20:03 ` [net-next] can: etas_es58x: fix null pointer dereference when handling error frames Marc Kleine-Budde
@ 2021-04-14 21:40 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-04-14 21:40 UTC (permalink / raw)
To: Marc Kleine-Budde; +Cc: netdev, davem, kuba, linux-can, kernel
Hello:
This pull request was applied to netdev/net-next.git (refs/heads/master):
On Wed, 14 Apr 2021 22:03:51 +0200 you wrote:
> Hello Jakub, hello David,
>
> this is a pull request of a single patch for net-next/master.
>
> Vincent Mailhol's patch fixes a NULL pointer dereference when handling
> error frames in the etas_es58x driver, which has been added in the
> previous PR.
>
> [...]
Here is the summary with links:
- pull-request: can-next 2021-04-14
https://git.kernel.org/netdev/net-next/c/3a1aa533f7f6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-14 21:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-14 20:03 pull-request: can-next 2021-04-14 Marc Kleine-Budde
2021-04-14 20:03 ` [net-next] can: etas_es58x: fix null pointer dereference when handling error frames Marc Kleine-Budde
2021-04-14 21:40 ` patchwork-bot+netdevbpf
2021-04-14 21:40 ` pull-request: can-next 2021-04-14 patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).