This series fix three bugs which all have the same root cause.
When calling netif_rx(skb) and its variants, the skb will eventually
get consumed (or freed) and thus it is unsafe to dereference it after
the call returns.
This remark especially applies to any variable with aliases the skb
memory which is the case of the can(fd)_frame.
The pattern is as this:
skb = alloc_can_skb(dev, &cf);
/* Do stuff */
netif_rx(skb);
stats->rx_bytes += cf->len;
Increasing the stats should be done *before* the call to netif_rx()
while the skb is still safe to use.
Changes since v2:
- rebase on net/master
- Added a comment towards upstream in patch 1/3 to inform about a
conflict which will occur when net-next and net are merged
Ref: https://lore.kernel.org/linux-can/20210120085356.m7nabbw5zhy7prpo@xxxxxxxxxxxxxxxxxxxxxxxx/
Changes since v1:
- fix a silly typo in patch 2/3 (variable len was declared twice...)
Vincent Mailhol (3):
can: dev: can_restart: fix use after free bug
can: vxcan: vxcan_xmit: fix use after free bug
can: peak_usb: fix use after free bugs
drivers/net/can/dev.c | 4 ++--
drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 ++++----
drivers/net/can/vxcan.c | 6 ++++--
3 files changed, 10 insertions(+), 8 deletions(-)
base-commit: 9c30ae8398b0813e237bde387d67a7f74ab2db2d
--
2.26.2
