Commit 50aca891 authored by Vincent Mailhol's avatar Vincent Mailhol Committed by Marc Kleine-Budde
Browse files

can: peak_usb: fix use after free bugs 

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

Fixes: 0a25e1f4 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr


Signed-off-by: default avatarVincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 75854cad

drivers/net/can/usb/peak_usb/pcan_usb_fd.c

+4 −4
Original line number Diff line number Diff line
@@ -514,11 +514,11 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, 
	else

		memcpy(cfd->data, rm->d, cfd->len);



	peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low));



	netdev->stats.rx_packets++;

	netdev->stats.rx_bytes += cfd->len;



	peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low));



	return 0;

}
@@ -580,11 +580,11 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, 
	if (!skb)

		return -ENOMEM;



	peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low));



	netdev->stats.rx_packets++;

	netdev->stats.rx_bytes += cf->len;



	peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low));



	return 0;

}