On Sat, Dec 11, 2021 at 10:23:06PM +0100, Marc Kleine-Budde wrote:
> From: Vincent Mailhol <mailhol.vincent@xxxxxxxxxx>
>
> commit 94cddf1e9227a171b27292509d59691819c458db upstream.
>
> After calling netif_receive_skb(skb), dereferencing skb is unsafe.
> Especially, the can_frame cf which aliases skb memory is dereferenced
> just after the call netif_receive_skb(skb).
>
> Reordering the lines solves the issue.
>
> Fixes: b21d18b51b31 ("can: Topcliff: Add PCH_CAN driver.")
> Link: https://lore.kernel.org/all/20211123111654.621610-1-mailhol.vincent@xxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Vincent Mailhol <mailhol.vincent@xxxxxxxxxx>
> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
> [mkl: backport to v5.10]
> Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
> ---
> Hey Greg,
>
> this is the backport of
> | 94cddf1e9227 ("can: pch_can: pch_can_rx_normal: fix use after free")
> to v5.10
Now queued up, thanks.
greg k-h
