Re: [PATCH net-next 29/37] can: esd: acc_start_xmit(): avoid use-after-free of skb after can_put_echo_skb()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] can: esd: reversed payload bytes on Big-Endian systems
--

commit ec092ddca47eb36deace0335dca8d7166cad0410
Author: Marc Kleine-Budde <mkl@pengutronix.de>

can: esd: acc_start_xmit(): avoid use-after-free of skb after can_put_echo_skb()

After the call to can_put_echo_skb() in acc_start_xmit() the skb is invalid
and not accessed anymore, but acc_txq_put() will access the skb's data.

Link: https://patch.msgid.link/20260929-esd-fix-skb-deref-v2-1-542e3e19fb25@pengutronix.de

> diff --git a/drivers/net/can/esd/esdacc.c b/drivers/net/can/esd/esdacc.c
> index 73e66f9a3781c..05d41ed34a02e 100644
> --- a/drivers/net/can/esd/esdacc.c
> +++ b/drivers/net/can/esd/esdacc.c
> @@ -62,14 +62,17 @@ static void acc_resetmode_leave(struct acc_core *core)
>  	acc_resetmode_entered(core);
>  }
>  
> -static void acc_txq_put(struct acc_core *core, u32 acc_id, u32 acc_dlc,
> -			const void *data)
> +static void acc_txq_put(struct acc_core *core, u32 acc_dlc, const void *data)
>  {
>  	acc_write32_noswap(core, ACC_CORE_OF_TXFIFO_DATA_1,
>  			   *((const u32 *)(data + 4)));
>  	acc_write32_noswap(core, ACC_CORE_OF_TXFIFO_DATA_0,
>  			   *((const u32 *)data));

[Severity: High]
Looking at acc_txq_put() in drivers/net/can/esd/esdacc.c, does this code
reverse payload bytes on Big-Endian systems?

The direct cast *((const u32 *)(data)) reads the 8-byte CAN payload as a
host-endian 32-bit integer. On Big-Endian architectures, this reads bytes 0-3
as (data[0]<<24) | ... | data[3]. The acc_write32_noswap() function then
calls iowrite32(), which byte-swaps the integer to Little-Endian format for
the PCI bus. As a result, the hardware FIFO receives the payload bytes in
reverse order: data[3], data[2], data[1], data[0].

Would it be better to use get_unaligned_le32() here to construct a
Little-Endian integer regardless of host architecture, ensuring iowrite32()
always outputs data[0] to the lowest address?

>  	acc_write32(core, ACC_CORE_OF_TXFIFO_DLC, acc_dlc);
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015015336.816543-1-mkl@pengutronix.de?part=29