can: peak_usb: fix use after free bugs
authorVincent Mailhol <mailhol.vincent@wanadoo.fr>
Wed, 20 Jan 2021 11:41:37 +0000 (20:41 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 Jan 2021 10:55:11 +0000 (11:55 +0100)
commitec939c13c3fff2114479769c8380b7f1a54feca9
treed0093ac11d41a63456750d283acc955d10e21ae6
parente771a874076115df8bff27d325edfd2340e4ec69
can: peak_usb: fix use after free bugs

[ Upstream commit 50aca891d7a554db0901b245167cd653d73aaa71 ]

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/can/usb/peak_usb/pcan_usb_fd.c