On Wed, Jan 20, 2021 at 01:25:09AM +0900, Vincent Mailhol wrote:

This series fix three bugs which all have the same root cause.

When calling netif_rx(skb) and its variants, the skb will eventually
get consumed (or freed) and thus it is unsafe to dereference it after
the call returns.

This remark especially applies to any variable with aliases the skb
memory which is the case of the can(fd)_frame.

The pattern is as this:
    skb = alloc_can_skb(dev, &cf);
    /* Do stuff */
    netif_rx(skb);
    stats->rx_bytes += cf->len;

Increasing the stats should be done *before* the call to netif_rx()
while the skb is still safe to use.

Vincent Mailhol (3):
  can: dev: can_restart: fix use after free bug
  can: vxcan: vxcan_xmit: fix use after free bug
  can: peak_usb: fix use after free bugs

 drivers/net/can/dev/dev.c                  | 4 ++--
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 ++++----
 drivers/net/can/vxcan.c                    | 6 ++++--
 3 files changed, 10 insertions(+), 8 deletions(-)


base-commit: 1105592cb8fdfcc96f2c9c693ff4106bac5fac7c
prerequisite-patch-id: d9d54d9159b70a5ef179d19d5add20caffbae638

As this are fixes, this should go into net/master (and then be be backported to
the stable kernels). Please rebase to net/master.

Of course there will be a merge conflict, when net-next and net are merged, due
to the moving and splitting of dev.c. You anticipated this and made noted that
as a prerequisite. (BTW: I don't find a commit for
d9d54d9159b70a5ef179d19d5add20caffbae638).

The kernel way to deal with this is to inform the upstream of the problem. A
trivial merge conflict, can be I think described in words, like: "The dev.c
file has been moved, carry the patch forward." I don't know the procedure for
more complicated merges :)

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |