[PATCH v2 net] can: peak_usb: fix use-after-free on PCAN-USB disconnect and init failure

The PCAN-USB adapter uses a restart_timer for bus error recovery
but does not define a dev_free callback.  When the device is
unplugged, peak_usb_disconnect() frees the candev without cancelling
the timer.  If a bus error armed the timer and USB disconnect races
with the timer callback, the timer fires on freed memory.

The same timer is initialized in pcan_usb_init() via timer_setup(),
but on error (e.g. failed USB command to read the serial number) the
function returns without cancelling it.  Because dev_init failure in
peak_usb_create_dev() jumps to lbl_unregister_candev and skips the
adap_dev_free label, the dev_free callback is never invoked either.

Add a pcan_usb_free() callback that calls timer_shutdown_sync() on
the restart_timer, register it as the adapter dev_free handler, and
also cancel the timer directly in pcan_usb_init() on error before
returning.

Fixes: 46be265d3388 ("can: usb: PEAK-System Technik PCAN-USB specific part")
Cc: <redacted>
Signed-off-by: Tristan Madani <redacted>
---
 drivers/net/can/usb/peak_usb/pcan_usb.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 8fd058c328564e..440d8e2cfb6fe6 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c

@@ -882,6 +882,14 @@ static int pcan_usb_start(struct peak_usb_device *dev)
 	return pcan_usb_set_ext_vcc(dev, 0);
 }
 
+static void pcan_usb_free(struct peak_usb_device *dev)
+{
+	struct pcan_usb *pdev =
+		container_of(dev, struct pcan_usb, dev);
+
+	timer_shutdown_sync(&pdev->restart_timer);
+}
+
 static int pcan_usb_init(struct peak_usb_device *dev)
 {
 	struct pcan_usb *pdev = container_of(dev, struct pcan_usb, dev);

@@ -901,6 +909,7 @@ static int pcan_usb_init(struct peak_usb_device *dev)
 		dev_err(dev->netdev->dev.parent,
 			"unable to read %s serial number (err %d)\n",
 			pcan_usb.name, err);
+		timer_shutdown_sync(&pdev->restart_timer);
 		return err;
 	}
 

@@ -1051,6 +1060,7 @@ const struct peak_usb_adapter pcan_usb = {
 	.dev_decode_buf = pcan_usb_decode_buf,
 	.dev_encode_msg = pcan_usb_encode_msg,
 	.dev_start = pcan_usb_start,
+	.dev_free = pcan_usb_free,
 	.dev_restart_async = pcan_usb_restart_async,
 	.do_get_berr_counter = pcan_usb_get_berr_counter,
 };

-- 
2.47.3