From: Marc Kleine-Budde <mkl@pengutronix.de>
To: netdev@vger.kernel.org
Cc: davem@davemloft.net, kuba@kernel.org, linux-can@vger.kernel.org,
kernel@pengutronix.de,
Zhang Changzhong <zhangchangzhong@huawei.com>,
stable@vger.kernel.org, Oleksij Rempel <o.rempel@pengutronix.de>,
Marc Kleine-Budde <mkl@pengutronix.de>
Subject: [PATCH net 03/11] can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length
Date: Sun, 17 Oct 2021 23:01:34 +0200 [thread overview]
Message-ID: <20211017210142.2108610-4-mkl@pengutronix.de> (raw)
In-Reply-To: <20211017210142.2108610-1-mkl@pengutronix.de>
From: Zhang Changzhong <zhangchangzhong@huawei.com>
According to SAE-J1939-21, the data length of TP.DT must be 8 bytes, so
cancel session when receive unexpected TP.DT message.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/1632972800-45091-1-git-send-email-zhangchangzhong@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
net/can/j1939/transport.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index bfb0718d4587..1ea6fee3d986 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1788,6 +1788,7 @@ static void j1939_xtp_rx_dpo(struct j1939_priv *priv, struct sk_buff *skb,
static void j1939_xtp_rx_dat_one(struct j1939_session *session,
struct sk_buff *skb)
{
+ enum j1939_xtp_abort abort = J1939_XTP_ABORT_FAULT;
struct j1939_priv *priv = session->priv;
struct j1939_sk_buff_cb *skcb, *se_skcb;
struct sk_buff *se_skb = NULL;
@@ -1802,9 +1803,11 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session,
skcb = j1939_skb_to_cb(skb);
dat = skb->data;
- if (skb->len <= 1)
+ if (skb->len != 8) {
/* makes no sense */
+ abort = J1939_XTP_ABORT_UNEXPECTED_DATA;
goto out_session_cancel;
+ }
switch (session->last_cmd) {
case 0xff:
@@ -1903,7 +1906,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session,
out_session_cancel:
kfree_skb(se_skb);
j1939_session_timers_cancel(session);
- j1939_session_cancel(session, J1939_XTP_ABORT_FAULT);
+ j1939_session_cancel(session, abort);
j1939_session_put(session);
}
--
2.33.0
next prev parent reply other threads:[~2021-10-17 21:01 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-17 21:01 pull-request: can 2021-10-17 Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 01/11] can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 02/11] can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv Marc Kleine-Budde
2021-10-17 21:01 ` Marc Kleine-Budde [this message]
2021-10-17 21:01 ` [PATCH net 04/11] can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 05/11] can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 06/11] can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in isotp_sendmsg() Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 07/11] can: rcar_can: fix suspend/resume Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 08/11] can: m_can: fix iomap_read_fifo() and iomap_write_fifo() Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 09/11] can: peak_pci: peak_pci_remove(): fix UAF Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 10/11] can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification Marc Kleine-Budde
2021-10-17 21:01 ` [PATCH net 11/11] can: peak_usb: pcan_usb_fd_decode_status(): remove unnecessary test on the nullity of a pointer Marc Kleine-Budde
2021-10-18 12:10 ` pull-request: can 2021-10-17 patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211017210142.2108610-4-mkl@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=davem@davemloft.net \
--cc=kernel@pengutronix.de \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=o.rempel@pengutronix.de \
--cc=stable@vger.kernel.org \
--cc=zhangchangzhong@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.