Vincent Mailhol 3e193ef4e0 can: pch_can: pch_can_rx_normal: fix use after free ...

commit 94cddf1e92 upstream.

After calling netif_receive_skb(skb), dereferencing skb is unsafe.
Especially, the can_frame cf which aliases skb memory is dereferenced
just after the call netif_receive_skb(skb).

Reordering the lines solves the issue.

Fixes: b21d18b51b ("can: Topcliff: Add PCH_CAN driver.")
Link: https://lore.kernel.org/all/20211123111654.621610-1-mailhol.vincent@wanadoo.fr
Cc: stable@vger.kernel.org
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-12-14 10:18:06 +01:00

..

appletalk

…

arcnet

…

bonding

bonding: make tx_rebalance_counter an atomic

2021-12-14 10:18:05 +01:00

caif

…

can

can: pch_can: pch_can_rx_normal: fix use after free

2021-12-14 10:18:06 +01:00

dsa

net: dsa: rtl8366rb: Fix off-by-one bug

2021-11-26 11:36:07 +01:00

ethernet

nfp: Fix memory leak in nfp_cpp_area_cache_add()

2021-12-14 10:18:05 +01:00

fddi

…

fjes

…

hamradio

net: 6pack: Fix tx timeout and slot time

2021-10-06 15:31:18 +02:00

hippi

…

hyperv

…

ieee802154

…

ipvlan

…

netdevsim

…

phy

net: phylink: avoid mvneta warning when setting pause parameters

2021-11-26 11:36:11 +01:00

plip

…

ppp

…

slip

…

team

…

usb

net: usb: lan78xx: lan78xx_phy_init(): use PHY_POLL instead of "0" if no IRQ is available

2021-12-08 08:50:13 +01:00

vmxnet3

vmxnet3: do not stop tx queues after netif_device_detach()

2021-11-26 11:35:59 +01:00

wan

…

wimax

…

wireless

wcn36xx: add proper DMA memory barriers in rx path

2021-11-26 11:36:11 +01:00

xen-netback

xen-netback: correct success/error reporting for the SKB-with-fraglist case

2021-10-09 14:11:03 +02:00

dummy.c

…

eql.c

…

geneve.c

…

gtp.c

…

ifb.c

…

Kconfig

…

LICENSE.SRC

…

loopback.c

…

macsec.c

…

macvlan.c

…

macvtap.c

…

Makefile

…

mdio.c

…

mii.c

…

net_failover.c

…

netconsole.c

…

nlmon.c

…

ntb_netdev.c

…

rionet.c

…

sb1000.c

…

Space.c

…

sungem_phy.c

…

tap.c

…

thunderbolt.c

…

tun.c

tun: fix bonding active backup with arp monitoring

2021-11-26 11:36:23 +01:00

veth.c

…

virtio_net.c

…

vrf.c

vrf: Reset IPCB/IP6CB when processing outbound pkts in vrf dev xmit

2021-12-08 08:50:12 +01:00

vsockmon.c

…

vxlan.c

…

xen-netfront.c

xen/netfront: don't trust the backend response data blindly

2021-12-01 09:27:44 +01:00