From: Vincent Mailhol Date: Tue, 13 Apr 2021 11:42:42 +0000 (+0900) Subject: can: etas_es58x: fix null pointer dereference when handling error frames X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=e2b1e4b532abdd39bfb7313146153815e370d60c;p=linux.git can: etas_es58x: fix null pointer dereference when handling error frames During the handling of CAN bus errors, a CAN error SKB is allocated using alloc_can_err_skb(). Even if the allocation of the SKB fails, the function continues in order to do the stats handling. All access to the can_frame pointer (cf) should be guarded by an if statement: if (cf) However, the increment of the rx_bytes stats: netdev->stats.rx_bytes += cf->can_dlc; dereferences the cf pointer and was not guarded by an if condition leading to a NULL pointer dereference if the can_err_skb() function failed. Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the length of any CAN error frames) solves this NULL pointer dereference. Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Link: https://lore.kernel.org/r/20210413114242.2760-1-mailhol.vincent@wanadoo.fr Reported-by: Arunachalam Santhanam Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde --- diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index 7222b3b6ca467..57e5f94468e92 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -856,7 +856,7 @@ int es58x_rx_err_msg(struct net_device *netdev, enum es58x_err error, * consistency. */ netdev->stats.rx_packets++; - netdev->stats.rx_bytes += cf->can_dlc; + netdev->stats.rx_bytes += CAN_ERR_DLC; if (cf) { if (cf->data[1])