pull-request: can 2021-01-13

pull-request: can 2021-01-13

[Marc Kleine-Budde]

Hello Jakub, hello David,

this is a pull request of 2 patches for net/master.

The first patch is by Oliver Hartkopp for the CAn ISO-TP protocol and fixes a
kernel information leak to userspace.

The last patch is by Qinglang Miao for the mcp251xfd driver and fixes a NULL
pointer check to work on the correct variable.

regards,
Marc

---

The following changes since commit a95d25dd7b94a5ba18246da09b4218f132fed60e:

  rxrpc: Call state should be read with READ_ONCE() under some circumstances (2021-01-13 10:38:20 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.11-20210113

for you to fetch changes up to ca4c6ebeeb50112f5178f14bfb6d9e8ddf148545:

  can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check (2021-01-13 22:16:16 +0100)

----------------------------------------------------------------
linux-can-fixes-for-5.11-20210113

----------------------------------------------------------------
Oliver Hartkopp (1):
      can: isotp: isotp_getname(): fix kernel information leak

Qinglang Miao (1):
      can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check

 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
 net/can/isotp.c                                | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

[net 1/2] can: isotp: isotp_getname(): fix kernel information leak

[Marc Kleine-Budde]

From: Oliver Hartkopp <socketcan@hartkopp.net>

Initialize the sockaddr_can structure to prevent a data leak to user space.

Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 net/can/isotp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 7839c3b9e5be..3ef7f78e553b 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1155,6 +1155,7 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
 	if (peer)
 		return -EOPNOTSUPP;
 
+	memset(addr, 0, sizeof(*addr));
 	addr->can_family = AF_CAN;
 	addr->can_ifindex = so->ifindex;
 	addr->can_addr.tp.rx_id = so->rxid;

base-commit: a95d25dd7b94a5ba18246da09b4218f132fed60e
-- 
2.29.2

[net 2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check

[Marc Kleine-Budde]

From: Qinglang Miao <miaoqinglang@huawei.com>

If alloc_canfd_skb() returns NULL, 'cfg' is an uninitialized variable, so we
should check 'skb' rather than 'cfd' after calling alloc_canfd_skb(priv->ndev,
&cfd).

Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20210113073100.79552-1-miaoqinglang@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 36235afb0bc6..f07e8b737d31 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1491,7 +1491,7 @@ mcp251xfd_handle_rxif_one(struct mcp251xfd_priv *priv,
 	else
 		skb = alloc_can_skb(priv->ndev, (struct can_frame **)&cfd);
 
-	if (!cfd) {
+	if (!skb) {
 		stats->rx_dropped++;
 		return 0;
 	}
-- 
2.29.2

Re: [net 1/2] can: isotp: isotp_getname(): fix kernel information leak

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Wed, 13 Jan 2021 22:21:57 +0100 you wrote:
> From: Oliver Hartkopp <socketcan@hartkopp.net>
> 
> Initialize the sockaddr_can structure to prevent a data leak to user space.
> 
> Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
> Reported-by: syzbot+057884e2f453e8afebc8@syzkaller.appspotmail.com
> Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
> Link: https://lore.kernel.org/r/20210112091643.11789-1-socketcan@hartkopp.net
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> 
> [...]

Here is the summary with links:
  - [net,1/2] can: isotp: isotp_getname(): fix kernel information leak
    https://git.kernel.org/netdev/net/c/b42b3a2744b3
  - [net,2/2] can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
    https://git.kernel.org/netdev/net/c/ca4c6ebeeb50

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html