Anssi Hannula 1139321161 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB ... [ Upstream commit ef79f00be7 ] can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi> Fixes: 1598efe57b ("can: xilinx_can: refactor code in preparation for CAN FD support") Link: https://patch.msgid.link/20250822095002.168389-1-anssi.hannula@bitwise.fi [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention] Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-09-19 16:29:58 +02:00
..
appletalk	…
arcnet	…
bonding	…
caif	…
can	can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB	2025-09-19 16:29:58 +02:00
dsa	…
ethernet	i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path	2025-09-19 16:29:58 +02:00
fddi	…
fjes	…
hamradio	…
hippi	…
hyperv	…
ieee802154	…
ipa	…
ipvlan	…
mctp	…
mdio	…
netdevsim	…
pcs	…
phy	…
plip	…
ppp	…
pse-pd	…
slip	…
team	…
usb	…
vmxnet3	…
vxlan	…
wan	…
wireguard	…
wireless	…
wwan	…
xen-netback	…
Kconfig	…
LICENSE.SRC	…
Makefile	…
Space.c	…
amt.c	…
bareudp.c	…
dummy.c	…
eql.c	…
geneve.c	…
gtp.c	…
ifb.c	…
loopback.c	…
macsec.c	…
macvlan.c	…
macvtap.c	…
mdio.c	…
mhi_net.c	…
mii.c	…
net_failover.c	…
netconsole.c	…
nlmon.c	…
ntb_netdev.c	…
rionet.c	…
sb1000.c	…
sungem_phy.c	…
tap.c	…
thunderbolt.c	…
tun.c	…
veth.c	…
virtio_net.c	…
vrf.c	…
vsockmon.c	…
xen-netfront.c	…