Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 13 Apr 2021 14:00:42 +0200
From:   Marc Kleine-Budde <mkl@pengutronix.de>
To:     Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Cc:     linux-can@vger.kernel.org, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org,
        Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>,
        "David S . Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>
Subject: Re: [PATCH] can: etas_es58x: fix null pointer dereference when
 handling error frames
Message-ID: <20210413120042.27sfrb4hgrr4ua7x@pengutronix.de>
References: <20210413114242.2760-1-mailhol.vincent@wanadoo.fr>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="7vvsamthpjzsb2d4"
Content-Disposition: inline
In-Reply-To: <20210413114242.2760-1-mailhol.vincent@wanadoo.fr>
Precedence: bulk


--7vvsamthpjzsb2d4
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 13.04.2021 20:42:42, Vincent Mailhol wrote:
> During the handling of CAN bus errors, a CAN error SKB is allocated
> using alloc_can_err_skb(). Even if the allocation of the SKB fails,
> the function continues in order to do the stats handling.
>=20
> All access to the can_frame pointer (cf) should be guarded by an if
> statement:
> 	if (cf)
>=20
> However, the increment of the rx_bytes stats:
> 	netdev->stats.rx_bytes +=3D cf->can_dlc;
> dereferences the cf pointer and was not guarded by an if condition
> leading to a NULL pointer dereference if the can_err_skb() function
> failed.
>=20
> Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the
> length of any CAN error frames) solves this NULL pointer dereference.
>=20
> Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CA=
N USB interfaces")
> Reported-by: Arunachalam Santhanam <arunachalam.santhanam@in.bosch.com>
> Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
> ---
> Hi Marc,
>=20
> I am really sorry, but I was just notified about this issue litteraly
> a few minutes after you send the pull request to net-next.

:D

> I am not sure how to proceed. You might either cancel the pull request
> and squash this to 8537257874e9 ("can: etas_es58x: add core support
> for ETAS ES58X CAN USB interfaces") or send it as a separate patch.
>=20
> Please let me know if you need me to do anything.

I'll send a follow-up pull request tomorrow.

regards,
Marc

--=20
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |

--7vvsamthpjzsb2d4
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEK3kIWJt9yTYMP3ehqclaivrt76kFAmB1h+cACgkQqclaivrt
76lw3wf8C32JuHk0dtao8qjHSHf9MLq8zaBkN4GxmtHvBMRajZUMxi3VgpXQcxon
Mqu3zDFb57e+WD/7M0bbO2V3Blx6aH34uGKt+loMrZjDspJqo60Ut3yz4qT3sIzN
mMIWYypg0Debofg4c9XKeKsTK5uq/5O7u24nhsGqRH6sw009mNVLB7T2ERaZmW9N
cqpgkG4AzAaPvtgm89EmGSNWd7DsGJFtSZpyRFAu/86nxfx1w8+/qoNSvYs+HdXH
Kn/X+lg3Znzd0GaSUa2YdIjveTZ7OFVw+ZfiTy8/AWcxEzfwrunTGJ7AJJIDR5oU
xwLBtNNKnTvWuNUROuEADqozeiwNuA==
=ILb7
-----END PGP SIGNATURE-----

--7vvsamthpjzsb2d4--