lkml.org 
[lkml]   [2021]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 29/58] can: vxcan: vxcan_xmit: fix use after free bug
    Date
    From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>

    [ Upstream commit 75854cad5d80976f6ea0f0431f8cedd3bcc475cb ]

    After calling netif_rx_ni(skb), dereferencing skb is unsafe.
    Especially, the canfd_frame cfd which aliases skb memory is accessed
    after the netif_rx_ni().

    Fixes: a8f820a380a2 ("can: add Virtual CAN Tunnel driver (vxcan)")
    Link: https://lore.kernel.org/r/20210120114137.200019-3-mailhol.vincent@wanadoo.fr
    Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/can/vxcan.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c
    index ed6828821fbd3..ccd758ba3fb09 100644
    --- a/drivers/net/can/vxcan.c
    +++ b/drivers/net/can/vxcan.c
    @@ -49,6 +49,7 @@ static netdev_tx_t vxcan_xmit(struct sk_buff *skb, struct net_device *dev)
    struct net_device *peer;
    struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
    struct net_device_stats *peerstats, *srcstats = &dev->stats;
    + u8 len;

    if (can_dropped_invalid_skb(dev, skb))
    return NETDEV_TX_OK;
    @@ -71,12 +72,13 @@ static netdev_tx_t vxcan_xmit(struct sk_buff *skb, struct net_device *dev)
    skb->dev = peer;
    skb->ip_summed = CHECKSUM_UNNECESSARY;

    + len = cfd->len;
    if (netif_rx_ni(skb) == NET_RX_SUCCESS) {
    srcstats->tx_packets++;
    - srcstats->tx_bytes += cfd->len;
    + srcstats->tx_bytes += len;
    peerstats = &peer->stats;
    peerstats->rx_packets++;
    - peerstats->rx_bytes += cfd->len;
    + peerstats->rx_bytes += len;
    }

    out_unlock:
    --
    2.27.0


    \
     
     \ /
      Last update: 2021-01-26 09:39    [W:2.320 / U:0.696 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site