From: Vincent Mailhol Date: Wed, 20 Jan 2021 11:41:35 +0000 (+0900) Subject: can: dev: can_restart: fix use after free bug X-Git-Tag: v5.15~1953^2^2~2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=03f16c5075b22c8902d2af739969e878b0879c94;p=platform%2Fkernel%2Flinux-starfive.git can: dev: can_restart: fix use after free bug After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue. Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde --- diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c index 3486704..8b1ae02 100644 --- a/drivers/net/can/dev.c +++ b/drivers/net/can/dev.c @@ -592,11 +592,11 @@ static void can_restart(struct net_device *dev) cf->can_id |= CAN_ERR_RESTARTED; - netif_rx_ni(skb); - stats->rx_packets++; stats->rx_bytes += cf->len; + netif_rx_ni(skb); + restart: netdev_dbg(dev, "restarted\n"); priv->can_stats.restarts++;