| Message ID | 20210413114242.2760-1-mailhol.vincent@wanadoo.fr (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | can: etas_es58x: fix null pointer dereference when handling error frames | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Series ignored based on subject |
On 13.04.2021 20:42:42, Vincent Mailhol wrote: > During the handling of CAN bus errors, a CAN error SKB is allocated > using alloc_can_err_skb(). Even if the allocation of the SKB fails, > the function continues in order to do the stats handling. > > All access to the can_frame pointer (cf) should be guarded by an if > statement: > if (cf) > > However, the increment of the rx_bytes stats: > netdev->stats.rx_bytes += cf->can_dlc; > dereferences the cf pointer and was not guarded by an if condition > leading to a NULL pointer dereference if the can_err_skb() function > failed. > > Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the > length of any CAN error frames) solves this NULL pointer dereference. > > Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") > Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com> > Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> > --- > Hi Marc, > > I am really sorry, but I was just notified about this issue litteraly > a few minutes after you send the pull request to net-next. :D > I am not sure how to proceed. You might either cancel the pull request > and squash this to 8537257874e9 ("can: etas_es58x: add core support > for ETAS ES58X CAN USB interfaces") or send it as a separate patch. > > Please let me know if you need me to do anything. I'll send a follow-up pull request tomorrow. regards, Marc
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index 7222b3b6ca46..57e5f94468e9 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -856,7 +856,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error, * consistency. */ netdev->stats.rx_packets++; - netdev->stats.rx_bytes += cf->can_dlc; + netdev->stats.rx_bytes += CAN_ERR_DLC; if (cf) { if (cf->data[1])
During the handling of CAN bus errors, a CAN error SKB is allocated using alloc_can_err_skb(). Even if the allocation of the SKB fails, the function continues in order to do the stats handling. All access to the can_frame pointer (cf) should be guarded by an if statement: if (cf) However, the increment of the rx_bytes stats: netdev->stats.rx_bytes += cf->can_dlc; dereferences the cf pointer and was not guarded by an if condition leading to a NULL pointer dereference if the can_err_skb() function failed. Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the length of any CAN error frames) solves this NULL pointer dereference. Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com> Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> --- Hi Marc, I am really sorry, but I was just notified about this issue litteraly a few minutes after you send the pull request to net-next. I am not sure how to proceed. You might either cancel the pull request and squash this to 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") or send it as a separate patch. Please let me know if you need me to do anything. Yours sincerely, Vincent Mailhol --- drivers/net/can/usb/etas_es58x/es58x_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)