diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2014-04-11 08:13:12 +0000 |
|---|---|---|
| committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2014-04-24 22:08:56 +0200 |
| commit | 9c64863a49bd23c5a3a983680eb500f7796c81be (patch) | |
| tree | 37e1a62c1345857573118b06587f3defc4e94948 /drivers/net/can/c_can | |
| parent | ef1d2e286a2d8876e03a3f58ea1a1f549727e518 (diff) | |
| download | linux-9c64863a49bd23c5a3a983680eb500f7796c81be.tar.bz2 | |
can: c_can: Do not access skb after net_receive_skb()
There is no guarantee that the skb is in the same state after calling
net_receive_skb(). It might be freed or reused. Not really harmful as
its a read access, except you turn on the proper debugging options
which catch a use after free.
The whole can subsystem is full of this. Copy and paste ....
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers/net/can/c_can')
| -rw-r--r-- | drivers/net/can/c_can/c_can.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c index 8c725f40bc1d..603876109ba8 100644 --- a/drivers/net/can/c_can/c_can.c +++ b/drivers/net/can/c_can/c_can.c @@ -429,10 +429,10 @@ static int c_can_read_msg_object(struct net_device *dev, int iface, int ctrl) } } - netif_receive_skb(skb); - stats->rx_packets++; stats->rx_bytes += frame->can_dlc; + + netif_receive_skb(skb); return 0; } @@ -960,9 +960,9 @@ static int c_can_handle_state_change(struct net_device *dev, break; } - netif_receive_skb(skb); stats->rx_packets++; stats->rx_bytes += cf->can_dlc; + netif_receive_skb(skb); return 1; } @@ -1033,10 +1033,9 @@ static int c_can_handle_bus_err(struct net_device *dev, /* set a `lec` value so that we can check for updates later */ priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED); - netif_receive_skb(skb); stats->rx_packets++; stats->rx_bytes += cf->can_dlc; - + netif_receive_skb(skb); return 1; } |