Commit ef79f00b authored Aug 22, 2025 by Anssi Hannula Committed by Marc Kleine-Budde Sep 10, 2025

can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB



can_put_echo_skb() takes ownership of the SKB and it may be freed
during or after the call.

However, xilinx_can xcan_write_frame() keeps using SKB after the call.

Fix that by only calling can_put_echo_skb() after the code is done
touching the SKB.

The tx_lock is held for the entire xcan_write_frame() execution and
also on the can_get_echo_skb() side so the order of operations does not
matter.

An earlier fix commit 3d3c817c ("can: xilinx_can: Fix usage of skb
memory") did not move the can_put_echo_skb() call far enough.

Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Fixes: 1598efe5 ("can: xilinx_can: refactor code in preparation for CAN FD support")
Link: https://patch.msgid.link/20250822095002.168389-1-anssi.hannula@bitwise.fi


[mkl: add "commit" in front of sha1 in patch description]
[mkl: fix indention]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

parent 06e02da2

drivers/net/can/xilinx_can.c

+8 −8

Original line number	Diff line number	Diff line
		@@ -690,14 +690,6 @@ static void xcan_write_frame(struct net_device ndev, struct sk_buff skb,
		dlc \|= XCAN_DLCR_EDL_MASK;
		}

		if (!(priv->devtype.flags & XCAN_FLAG_TX_MAILBOXES) &&
		(priv->devtype.flags & XCAN_FLAG_TXFEMP))
		can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max, 0);
		else
		can_put_echo_skb(skb, ndev, 0, 0);

		priv->tx_head++;

		priv->write_reg(priv, XCAN_FRAME_ID_OFFSET(frame_offset), id);
		/* If the CAN frame is RTR frame this write triggers transmission
		* (not on CAN FD)
		@@ -730,6 +722,14 @@ static void xcan_write_frame(struct net_device ndev, struct sk_buff skb,
		data[1]);
		}
		}

		if (!(priv->devtype.flags & XCAN_FLAG_TX_MAILBOXES) &&
		(priv->devtype.flags & XCAN_FLAG_TXFEMP))
		can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max, 0);
		else
		can_put_echo_skb(skb, ndev, 0, 0);

		priv->tx_head++;
		}

		/**