iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
31a75cbbb9
linux/drivers/net/can
History
Vincent Mailhol 50aca891d7 can: peak_usb: fix use after free bugs 
After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is accessed
after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.

Fixes: 0a25e1f4f1 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-01-20 13:33:28 +01:00
..
c_can Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-03 15:44:09 -08:00
cc770 can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
ifi_canfd can: rename CAN FD related can_len2dlc and can_dlc2len helpers 2020-11-20 12:05:14 +01:00
m_can can: tcan4x5x: fix bittiming const, use common bittiming from m_can driver 2021-01-07 09:27:19 +01:00
mscan can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
peak_canfd can: rename CAN FD related can_len2dlc and can_dlc2len helpers 2020-11-20 12:05:14 +01:00
rcar can: rcar: Kconfig: update help description for CAN_RCAR config 2021-01-07 11:02:10 +01:00
sja1000 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-03 15:44:09 -08:00
softing Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-11 22:29:38 -08:00
spi can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check 2021-01-13 22:16:16 +01:00
usb can: peak_usb: fix use after free bugs 2021-01-20 13:33:28 +01:00
at91_can.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
dev.c can: dev: can_restart: fix use after free bug 2021-01-20 13:32:05 +01:00
flexcan.c can: flexcan: convert the driver to DT-only 2020-12-10 10:40:10 +01:00
grcan.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
janz-ican3.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
Kconfig can: kvaser_pciefd: select CONFIG_CRC32 2021-01-05 15:50:36 -08:00
kvaser_pciefd.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-03 15:44:09 -08:00
led.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
Makefile can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices 2019-07-24 10:31:53 +02:00
pch_can.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
rx-offload.c can: rx-offload: can_rx_offload_offload_one(): avoid double unlikely() notation when using IS_ERR() 2020-12-10 10:10:43 +01:00
slcan.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
sun4i_can.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-03 15:44:09 -08:00
ti_hecc.c can: replace can_dlc as variable/element for payload length 2020-11-20 12:04:12 +01:00
vcan.c can: make use of preallocated can_ml_priv for per device struct can_dev_rcv_lists 2019-09-04 13:29:15 +02:00
vxcan.c can: vxcan: vxcan_xmit: fix use after free bug 2021-01-20 13:33:12 +01:00
xilinx_can.c can: rename CAN FD related can_len2dlc and can_dlc2len helpers 2020-11-20 12:05:14 +01:00