Netdev Archive on lore.kernel.org
 help / color / Atom feed
* pull-request: can 2021-01-13
@ 2021-01-13 21:21 Marc Kleine-Budde
  2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
  2021-01-13 21:21 ` [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check Marc Kleine-Budde
  0 siblings, 2 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-01-13 21:21 UTC (permalink / raw)
  To: netdev; +Cc: davem, kuba, linux-can, kernel

Hello Jakub, hello David,

this is a pull request of 2 patches for net/master.

The first patch is by Oliver Hartkopp for the CAn ISO-TP protocol and fixes a
kernel information leak to userspace.

The last patch is by Qinglang Miao for the mcp251xfd driver and fixes a NULL
pointer check to work on the correct variable.

regards,
Marc

---

The following changes since commit a95d25dd7b94a5ba18246da09b4218f132fed60e:

  rxrpc: Call state should be read with READ_ONCE() under some circumstances (2021-01-13 10:38:20 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.11-20210113

for you to fetch changes up to ca4c6ebeeb50112f5178f14bfb6d9e8ddf148545:

  can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check (2021-01-13 22:16:16 +0100)

----------------------------------------------------------------
linux-can-fixes-for-5.11-20210113

----------------------------------------------------------------
Oliver Hartkopp (1):
      can: isotp: isotp_getname(): fix kernel information leak

Qinglang Miao (1):
      can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check

 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
 net/can/isotp.c                                | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)



^ permalink raw reply	[flat|nested] 4+ messages in thread

* [net 1/2] can: isotp: isotp_getname(): fix kernel information leak
  2021-01-13 21:21 pull-request: can 2021-01-13 Marc Kleine-Budde
@ 2021-01-13 21:21 ` Marc Kleine-Budde
  2021-01-14  3:10   ` patchwork-bot+netdevbpf
  2021-01-13 21:21 ` [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check Marc Kleine-Budde
  1 sibling, 1 reply; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-01-13 21:21 UTC (permalink / raw)
  To: netdev
  Cc: davem, kuba, linux-can, kernel, Oliver Hartkopp, Cong Wang,
	syzbot+057884e2f453e8afebc8, Marc Kleine-Budde

From: Oliver Hartkopp <socketcan@hartkopp.net>

Initialize the sockaddr_can structure to prevent a data leak to user space.

Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 net/can/isotp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 7839c3b9e5be..3ef7f78e553b 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1155,6 +1155,7 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
 	if (peer)
 		return -EOPNOTSUPP;
 
+	memset(addr, 0, sizeof(*addr));
 	addr->can_family = AF_CAN;
 	addr->can_ifindex = so->ifindex;
 	addr->can_addr.tp.rx_id = so->rxid;

base-commit: a95d25dd7b94a5ba18246da09b4218f132fed60e
-- 
2.29.2



^ permalink raw reply	[flat|nested] 4+ messages in thread

* [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
  2021-01-13 21:21 pull-request: can 2021-01-13 Marc Kleine-Budde
  2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
@ 2021-01-13 21:21 ` Marc Kleine-Budde
  1 sibling, 0 replies; 4+ messages in thread
From: Marc Kleine-Budde @ 2021-01-13 21:21 UTC (permalink / raw)
  To: netdev
  Cc: davem, kuba, linux-can, kernel, Qinglang Miao,
	Manivannan Sadhasivam, Marc Kleine-Budde

From: Qinglang Miao <miaoqinglang@huawei.com>

If alloc_canfd_skb() returns NULL, 'cfg' is an uninitialized variable, so we
should check 'skb' rather than 'cfd' after calling alloc_canfd_skb(priv->ndev,
&cfd).

Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20210113073100.79552-1-miaoqinglang@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 36235afb0bc6..f07e8b737d31 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1491,7 +1491,7 @@ mcp251xfd_handle_rxif_one(struct mcp251xfd_priv *priv,
 	else
 		skb = alloc_can_skb(priv->ndev, (struct can_frame **)&cfd);
 
-	if (!cfd) {
+	if (!skb) {
 		stats->rx_dropped++;
 		return 0;
 	}
-- 
2.29.2



^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [net 1/2] can: isotp: isotp_getname(): fix kernel information leak
  2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
@ 2021-01-14  3:10   ` patchwork-bot+netdevbpf
  0 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-01-14  3:10 UTC (permalink / raw)
  To: Marc Kleine-Budde
  Cc: netdev, davem, kuba, linux-can, kernel, socketcan,
	xiyou.wangcong, syzbot+057884e2f453e8afebc8

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Wed, 13 Jan 2021 22:21:57 +0100 you wrote:
> From: Oliver Hartkopp <socketcan@hartkopp.net>
> 
> Initialize the sockaddr_can structure to prevent a data leak to user space.
> 
> Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
> Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
> Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.net
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> 
> [...]

Here is the summary with links:
  - [net,1/2] can: isotp: isotp_getname(): fix kernel information leak
    https://git.kernel.org/netdev/net/c/b42b3a2744b3
  - [net,2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
    https://git.kernel.org/netdev/net/c/ca4c6ebeeb50

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-13 21:21 pull-request: can 2021-01-13 Marc Kleine-Budde
2021-01-13 21:21 ` [net 1/2] can: isotp: isotp_getname(): fix kernel information leak Marc Kleine-Budde
2021-01-14  3:10   ` patchwork-bot+netdevbpf
2021-01-13 21:21 ` [net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check Marc Kleine-Budde

Netdev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netdev/0 netdev/git/0.git
	git clone --mirror https://lore.kernel.org/netdev/1 netdev/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netdev netdev/ https://lore.kernel.org/netdev \
		netdev@vger.kernel.org
	public-inbox-index netdev

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netdev


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git