Re: [PATCH v4 1/3] can: dev: can_restart: fix use after free bug

2021-01-20 Thread Vincent MAILHOL
On Wed. 20 janv. 2021 at 21:53, Marc Kleine-Budde wrote: > On 1/20/21 12:41 PM, Vincent Mailhol wrote: > > After calling netif_rx_ni(skb), dereferencing skb is unsafe. > > Especially, the can_frame cf which aliases skb memory is accessed > > after the netif_rx_ni() in: > > stats->rx_bytes +=

Re: [PATCH v4 1/3] can: dev: can_restart: fix use after free bug

2021-01-20 Thread Marc Kleine-Budde
On 1/20/21 12:41 PM, Vincent Mailhol wrote: > After calling netif_rx_ni(skb), dereferencing skb is unsafe. > Especially, the can_frame cf which aliases skb memory is accessed > after the netif_rx_ni() in: > stats->rx_bytes += cf->len; > > Reordering the lines solves the issue. > > Fixes: 39

[PATCH v4 1/3] can: dev: can_restart: fix use after free bug

2021-01-20 Thread Vincent Mailhol
After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len; Reordering the lines solves the issue. Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink inte