[PATCH v3 net] can: peak_usb: fix use-after-free on PCAN-USB disconnect

[PATCH v3 net] can: peak_usb: fix use-after-free on PCAN-USB disconnect

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

The PCAN-USB adapter uses a restart_timer for bus error recovery
but does not define a dev_free callback.  When the device is
unplugged, peak_usb_disconnect() frees the candev without cancelling
the timer.  If the restart URB completion handler
pcan_usb_restart_pending() has armed the timer and USB disconnect
races with the timer callback, the timer fires on freed memory.

Add a pcan_usb_free() callback that calls timer_shutdown_sync() on
the restart_timer and register it as the adapter dev_free handler so
that peak_usb_disconnect() drains the timer before freeing the
device.

Found by code review.

Fixes: 46be265d3388 ("can: usb: PEAK-System Technik PCAN-USB specific part")
Cc: stable@vger.kernel.org
Reviewed-by: Stéphane Grosjean <s.grosjean@peak-system.fr>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v3:
- Restrict fix to disconnect path per Stéphane Grosjean (init-failure
  path is addressed by his peak_usb series [1])
- Fix container_of to fit on one line
- Add discovery method per netdev-bot request

[1] https://lore.kernel.org/r/20261022-canfd_check_channel_idx-v6-9-197704231551@peak-system.fr

Changes in v2:
- Use timer_shutdown_sync() instead of del_timer_sync() to prevent
  rearming
 drivers/net/can/usb/peak_usb/pcan_usb.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 8fd058c328564..0926e9affa95a 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -882,6 +882,13 @@ static int pcan_usb_start(struct peak_usb_device *dev)
 	return pcan_usb_set_ext_vcc(dev, 0);
 }
 
+static void pcan_usb_free(struct peak_usb_device *dev)
+{
+	struct pcan_usb *pdev = container_of(dev, struct pcan_usb, dev);
+
+	timer_shutdown_sync(&pdev->restart_timer);
+}
+
 static int pcan_usb_init(struct peak_usb_device *dev)
 {
 	struct pcan_usb *pdev = container_of(dev, struct pcan_usb, dev);
@@ -1051,6 +1058,7 @@ const struct peak_usb_adapter pcan_usb = {
 	.dev_decode_buf = pcan_usb_decode_buf,
 	.dev_encode_msg = pcan_usb_encode_msg,
 	.dev_start = pcan_usb_start,
+	.dev_free = pcan_usb_free,
 	.dev_restart_async = pcan_usb_restart_async,
 	.do_get_berr_counter = pcan_usb_get_berr_counter,
 };
-- 
2.47.3