From: Vincent Mailhol Date: Wed, 20 Jan 2021 11:41:35 +0000 (+0900) Subject: can: dev: can_restart: fix use after free bug X-Git-Tag: v4.4.254~16 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=260925a0b7d2da5449f8ecfd02c1405e0c8a45b8;p=thirdparty%2Fkernel%2Fstable.git can: dev: can_restart: fix use after free bug [ Upstream commit 03f16c5075b22c8902d2af739969e878b0879c94 ] After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue. Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") Link: https://lore.kernel.org/r/20210120114137.200019-2-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c index 52110017fd401..45f15ac6b1015 100644 --- a/drivers/net/can/dev.c +++ b/drivers/net/can/dev.c @@ -525,11 +525,11 @@ static void can_restart(struct net_device *dev) } cf->can_id |= CAN_ERR_RESTARTED; - netif_rx_ni(skb); - stats->rx_packets++; stats->rx_bytes += cf->can_dlc; + netif_rx_ni(skb); + restart: netdev_dbg(dev, "restarted\n"); priv->can_stats.restarts++;