[PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int

[PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int

[Marc Kleine-Budde]

In isotp_rcv_ff() 32 bit of data received over the network is assigned
to struct tpcon::len. Later in that function the length is checked for
the maximal supported length against MAX_MSG_LENGTH.

As struct tpcon::len is an "int" this check does not work, if the
provided length overflows the "int".

Later on struct tpcon::idx is compared against struct tpcon::len.

To fix this problem this patch converts both struct tpcon::{idx,len}
to unsigned int.

Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
\# Cc: stable@vger.kernel.org
Cc: Oliver Hartkopp <socketcan@hartkopp.net>
Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 net/can/isotp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index df6968b28bf4..02cbcb2ecf0d 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -119,8 +119,8 @@ enum {
 };
 
 struct tpcon {
-	int idx;
-	int len;
+	unsigned int idx;
+	unsigned int len;
 	u32 state;
 	u8 bs;
 	u8 sn;
-- 
2.34.1

Re: [PATCH RFC] can: isotp: convert struct tpcon::{idx,len} to unsigned int

[Oliver Hartkopp]

On 05.01.22 14:24, Marc Kleine-Budde wrote:
> In isotp_rcv_ff() 32 bit of data received over the network is assigned
> to struct tpcon::len. Later in that function the length is checked for
> the maximal supported length against MAX_MSG_LENGTH.
> 
> As struct tpcon::len is an "int" this check does not work, if the
> provided length overflows the "int".
> 
> Later on struct tpcon::idx is compared against struct tpcon::len.
> 
> To fix this problem this patch converts both struct tpcon::{idx,len}
> to unsigned int.
> 
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> \# Cc: stable@vger.kernel.org
> Cc: Oliver Hartkopp <socketcan@hartkopp.net>

Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>

Thanks Marc!

> Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> ---
>   net/can/isotp.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/can/isotp.c b/net/can/isotp.c
> index df6968b28bf4..02cbcb2ecf0d 100644
> --- a/net/can/isotp.c
> +++ b/net/can/isotp.c
> @@ -119,8 +119,8 @@ enum {
>   };
>   
>   struct tpcon {
> -	int idx;
> -	int len;
> +	unsigned int idx;
> +	unsigned int len;
>   	u32 state;
>   	u8 bs;
>   	u8 sn;
>