From: Vincent Mailhol Date: Wed, 20 Jan 2021 11:41:35 +0000 (+0900) Subject: can: dev: can_restart: fix use after free bug X-Git-Tag: rel_imx_5.10.35_2.0.0-somdevices.0~363^2~2191 X-Git-Url: https://git.somdevices.com/?a=commitdiff_plain;h=593c072b7b3c4d7044416eb039d9ad706bedd67a;p=linux.git can: dev: can_restart: fix use after free bug [ Upstream commit 03f16c5075b22c8902d2af739969e878b0879c94 ] After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue. Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c index 81e39d7507d8..09879aea9f7c 100644 --- a/drivers/net/can/dev.c +++ b/drivers/net/can/dev.c @@ -592,11 +592,11 @@ static void can_restart(struct net_device *dev) cf->can_id |= CAN_ERR_RESTARTED; - netif_rx_ni(skb); - stats->rx_packets++; stats->rx_bytes += cf->can_dlc; + netif_rx_ni(skb); + restart: netdev_dbg(dev, "restarted\n"); priv->can_stats.restarts++;