netdev - Re: [PATCH] can: etas_es58x: fix null pointer dereference when handling error frames

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 13 Apr 2021 14:00:42 +0200
From:   Marc Kleine-Budde <mkl@...gutronix.de>
To:     Vincent Mailhol <mailhol.vincent@...adoo.fr>
Cc:     linux-can@...r.kernel.org, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org,
        Arunachalam Santhanam <arunachalam.santhanam@...bosch.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH] can: etas_es58x: fix null pointer dereference when
 handling error frames

On 13.04.2021 20:42:42, Vincent Mailhol wrote:
> During the handling of CAN bus errors, a CAN error SKB is allocated
> using alloc_can_err_skb(). Even if the allocation of the SKB fails,
> the function continues in order to do the stats handling.
> 
> All access to the can_frame pointer (cf) should be guarded by an if
> statement:
> 	if (cf)
> 
> However, the increment of the rx_bytes stats:
> 	netdev->stats.rx_bytes += cf->can_dlc;
> dereferences the cf pointer and was not guarded by an if condition
> leading to a NULL pointer dereference if the can_err_skb() function
> failed.
> 
> Replacing the cf->can_dlc by the macro CAN_ERR_DLC (which is the
> length of any CAN error frames) solves this NULL pointer dereference.
> 
> Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
> Reported-by: Arunachalam Santhanam <arunachalam.santhanam@...bosch.com>
> Signed-off-by: Vincent Mailhol <mailhol.vincent@...adoo.fr>
> ---
> Hi Marc,
> 
> I am really sorry, but I was just notified about this issue litteraly
> a few minutes after you send the pull request to net-next.

:D

> I am not sure how to proceed. You might either cancel the pull request
> and squash this to 8537257874e9 ("can: etas_es58x: add core support
> for ETAS ES58X CAN USB interfaces") or send it as a separate patch.
> 
> Please let me know if you need me to do anything.

I'll send a follow-up pull request tomorrow.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)