* pull-request: can 2021-01-13
@ 2021-01-13 21:21 Marc Kleine-Budde
2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
2021-01-13 21:21 ` [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check Marc Kleine-Budde
0 siblings, 2 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-01-13 21:21 UTC (permalink / raw)
To: netdev; +Cc: davem, kuba, linux-can, kernel
Hello Jakub, hello David,
this is a pull request of 2 patches for net/master.
The first patch is by Oliver Hartkopp for the CAn ISO-TP protocol and fixes a
kernel information leak to userspace.
The last patch is by Qinglang Miao for the mcp251xfd driver and fixes a NULL
pointer check to work on the correct variable.
regards,
Marc
---
The following changes since commit a95d25dd7b94a5ba18246da09b4218f132fed60e:
rxrpc: Call state should be read with READ_ONCE() under some circumstances (2021-01-13 10:38:20 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.11-20210113
for you to fetch changes up to ca4c6ebeeb50112f5178f14bfb6d9e8ddf148545:
can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check (2021-01-13 22:16:16 +0100)
----------------------------------------------------------------
linux-can-fixes-for-5.11-20210113
----------------------------------------------------------------
Oliver Hartkopp (1):
can: isotp: isotp_getname(): fix kernel information leak
Qinglang Miao (1):
can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
net/can/isotp.c | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
^ permalink raw reply [flat|nested] 4+ messages in thread
* [net 1/2] can: isotp: isotp_getname(): fix kernel information leak
2021-01-13 21:21 pull-request: can 2021-01-13 Marc Kleine-Budde
@ 2021-01-13 21:21 ` Marc Kleine-Budde
2021-01-14 3:10 ` patchwork-bot+netdevbpf
2021-01-13 21:21 ` [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check Marc Kleine-Budde
1 sibling, 1 reply; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-01-13 21:21 UTC (permalink / raw)
To: netdev
Cc: davem, kuba, linux-can, kernel, Oliver Hartkopp, Cong Wang,
syzbot+057884e2f453e8afebc8, Marc Kleine-Budde
From: Oliver Hartkopp <socketcan@hartkopp.net>
Initialize the sockaddr_can structure to prevent a data leak to user space.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
net/can/isotp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/can/isotp.c b/net/can/isotp.c
index 7839c3b9e5be..3ef7f78e553b 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1155,6 +1155,7 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
if (peer)
return -EOPNOTSUPP;
+ memset(addr, 0, sizeof(*addr));
addr->can_family = AF_CAN;
addr->can_ifindex = so->ifindex;
addr->can_addr.tp.rx_id = so->rxid;
base-commit: a95d25dd7b94a5ba18246da09b4218f132fed60e
--
2.29.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [net 1/2] can: isotp: isotp_getname(): fix kernel information leak
2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
@ 2021-01-14 3:10 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-01-14 3:10 UTC (permalink / raw)
To: Marc Kleine-Budde
Cc: netdev, davem, kuba, linux-can, kernel, socketcan,
xiyou.wangcong, syzbot+057884e2f453e8afebc8
Hello:
This series was applied to netdev/net.git (refs/heads/master):
On Wed, 13 Jan 2021 22:21:57 +0100 you wrote:
> From: Oliver Hartkopp <socketcan@hartkopp.net>
>
> Initialize the sockaddr_can structure to prevent a data leak to user space.
>
> Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
> Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
> Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.net
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
>
> [...]
Here is the summary with links:
- [net,1/2] can: isotp: isotp_getname(): fix kernel information leak
https://git.kernel.org/netdev/net/c/b42b3a2744b3
- [net,2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
https://git.kernel.org/netdev/net/c/ca4c6ebeeb50
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
2021-01-13 21:21 pull-request: can 2021-01-13 Marc Kleine-Budde
2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
@ 2021-01-13 21:21 ` Marc Kleine-Budde
1 sibling, 0 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-01-13 21:21 UTC (permalink / raw)
To: netdev
Cc: davem, kuba, linux-can, kernel, Qinglang Miao,
Manivannan Sadhasivam, Marc Kleine-Budde
From: Qinglang Miao <miaoqinglang@huawei.com>
If alloc_canfd_skb() returns NULL, 'cfg' is an uninitialized variable, so we
should check 'skb' rather than 'cfd' after calling alloc_canfd_skb(priv->ndev,
&cfd).
Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20210113073100.79552-1-miaoqinglang@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 36235afb0bc6..f07e8b737d31 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1491,7 +1491,7 @@ mcp251xfd_handle_rxif_one(struct mcp251xfd_priv *priv,
else
skb = alloc_can_skb(priv->ndev, (struct can_frame **)&cfd);
- if (!cfd) {
+ if (!skb) {
stats->rx_dropped++;
return 0;
}
--
2.29.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-01-14 3:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-13 21:21 pull-request: can 2021-01-13 Marc Kleine-Budde
2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
2021-01-14 3:10 ` patchwork-bot+netdevbpf
2021-01-13 21:21 ` [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check Marc Kleine-Budde
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).