* [PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int
@ 2022-01-05 13:24 Marc Kleine-Budde
2022-01-05 16:08 ` Oliver Hartkopp
0 siblings, 1 reply; 2+ messages in thread
From: Marc Kleine-Budde @ 2022-01-05 13:24 UTC (permalink / raw)
To: linux-can; +Cc: Marc Kleine-Budde, Oliver Hartkopp, syzbot+4c63f36709a642f801c5
In isotp_rcv_ff() 32 bit of data received over the network is assigned
to struct tpcon::len. Later in that function the length is checked for
the maximal supported length against MAX_MSG_LENGTH.
As struct tpcon::len is an "int" this check does not work, if the
provided length overflows the "int".
Later on struct tpcon::idx is compared against struct tpcon::len.
To fix this problem this patch converts both struct tpcon::{idx,len}
to unsigned int.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
\# Cc: stable@vger.kernel.org
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
net/can/isotp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/can/isotp.c b/net/can/isotp.c
index df6968b28bf4..02cbcb2ecf0d 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -119,8 +119,8 @@ enum {
};
struct tpcon {
- int idx;
- int len;
+ unsigned int idx;
+ unsigned int len;
u32 state;
u8 bs;
u8 sn;
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int
2022-01-05 13:24 [PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int Marc Kleine-Budde
@ 2022-01-05 16:08 ` Oliver Hartkopp
0 siblings, 0 replies; 2+ messages in thread
From: Oliver Hartkopp @ 2022-01-05 16:08 UTC (permalink / raw)
To: Marc Kleine-Budde, linux-can; +Cc: syzbot+4c63f36709a642f801c5
On 05.01.22 14:24, Marc Kleine-Budde wrote:
> In isotp_rcv_ff() 32 bit of data received over the network is assigned
> to struct tpcon::len. Later in that function the length is checked for
> the maximal supported length against MAX_MSG_LENGTH.
>
> As struct tpcon::len is an "int" this check does not work, if the
> provided length overflows the "int".
>
> Later on struct tpcon::idx is compared against struct tpcon::len.
>
> To fix this problem this patch converts both struct tpcon::{idx,len}
> to unsigned int.
>
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> \# Cc: stable@vger.kernel.org
> Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Thanks Marc!
> Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> ---
> net/can/isotp.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/net/can/isotp.c b/net/can/isotp.c
> index df6968b28bf4..02cbcb2ecf0d 100644
> --- a/net/can/isotp.c
> +++ b/net/can/isotp.c
> @@ -119,8 +119,8 @@ enum {
> };
>
> struct tpcon {
> - int idx;
> - int len;
> + unsigned int idx;
> + unsigned int len;
> u32 state;
> u8 bs;
> u8 sn;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-01-05 16:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-05 13:24 [PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int Marc Kleine-Budde
2022-01-05 16:08 ` Oliver Hartkopp
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.