From: Vincent Mailhol Date: Wed, 20 Jan 2021 11:41:35 +0000 (+0900) Subject: can: dev: can_restart: fix use after free bug X-Git-Tag: v4.19.171~30 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=08ab951787098ae0b6c0364aeea7a8138226f234;p=users%2Fdwmw2%2Flinux.git can: dev: can_restart: fix use after free bug [ Upstream commit 03f16c5075b22c8902d2af739969e878b0879c94 ] After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue. Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c index f88590074569e..953c6fdc75cc4 100644 --- a/drivers/net/can/dev.c +++ b/drivers/net/can/dev.c @@ -579,11 +579,11 @@ static void can_restart(struct net_device *dev) } cf->can_id |= CAN_ERR_RESTARTED; - netif_rx_ni(skb); - stats->rx_packets++; stats->rx_bytes += cf->can_dlc; + netif_rx_ni(skb); + restart: netdev_dbg(dev, "restarted\n"); priv->can_stats.restarts++;