Commit 54088246 authored Jan 20, 2021 by Vincent Mailhol Committed by Greg Kroah-Hartman Jan 27, 2021

can: peak_usb: fix use after free bugs

[ Upstream commit 50aca891d7a554db0901b245167cd653d73aaa71 ]

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

Fixes: 0a25e1f4 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr


Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 9b820875

drivers/net/can/usb/peak_usb/pcan_usb_fd.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -520,11 +520,11 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if,
		else
		memcpy(cfd->data, rm->d, cfd->len);

		peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low));

		netdev->stats.rx_packets++;
		netdev->stats.rx_bytes += cfd->len;

		peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low));

		return 0;
		}

		@@ -586,11 +586,11 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
		if (!skb)
		return -ENOMEM;

		peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low));

		netdev->stats.rx_packets++;
		netdev->stats.rx_bytes += cf->can_dlc;

		peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low));

		return 0;
		}