diff options
| author |   Vincent Mailhol <mailhol.vincent@wanadoo.fr> | 2021-04-13 20:42:42 +0900 |
|---|---|---|
| committer |   Marc Kleine-Budde <mkl@pengutronix.de> | 2021-04-14 09:32:12 +0200 |
| commit | e2b1e4b532abdd39bfb7313146153815e370d60c (patch) | |
| tree | 0531e280fdd167da225ad76c5fe7b19881c8db36 /drivers/net/can/usb | |
| parent | ionic: return -EFAULT if copy_to_user() fails (diff) | |
| download | linux-dev-e2b1e4b532abdd39bfb7313146153815e370d60c.tar.xz linux-dev-e2b1e4b532abdd39bfb7313146153815e370d60c.zip | |
can: etas_es58x: fix null pointer dereference when handling error frames
During the handling of CAN bus errors, a CAN error SKB is allocated
using alloc_can_err_skb(). Even if the allocation of the SKB fails,
the function continues in order to do the stats handling.
All access to the can_frame pointer (cf) should be guarded by an if
statement:
if (cf)
However, the increment of the rx_bytes stats:
netdev->stats.rx_bytes += cf->can_dlc;
dereferences the cf pointer and was not guarded by an if condition
leading to a NULL pointer dereference if the can_err_skb() function
failed.
Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the
length of any CAN error frames) solves this NULL pointer dereference.
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Link: https://lore.kernel.org/r/20210413114242.2760-1-mailhol.vincent@wanadoo.fr
Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers/net/can/usb')
| -rw-r--r-- | drivers/net/can/usb/etas_es58x/es58x_core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index 7222b3b6ca46..57e5f94468e9 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -856,7 +856,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error, * consistency. */ netdev->stats.rx_packets++; - netdev->stats.rx_bytes += cf->can_dlc; + netdev->stats.rx_bytes += CAN_ERR_DLC; if (cf) { if (cf->data[1]) |