| From 4b5f1f0d6555cf1e43aa2da8adf77ee8f34e21ff Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 4 Nov 2020 03:09:06 +0530 |
| Subject: can: af_can: prevent potential access of uninitialized member in |
| canfd_rcv() |
| |
| From: Anant Thazhemadam <anant.thazhemadam@gmail.com> |
| |
| [ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ] |
| |
| In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this |
| uninitialized cfd->len is accessed nonetheless by pr_warn_once(). |
| |
| Fix this uninitialized variable access by checking cfd->len's validity |
| condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's |
| condition is checked, and appropriately modify the log messages that |
| are generated as well. |
| In case either of the required conditions fail, the skb is freed and |
| NET_RX_DROP is returned, same as before. |
| |
| Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once") |
| Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com |
| Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> |
| Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> |
| Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/can/af_can.c | 19 ++++++++++++++----- |
| 1 file changed, 14 insertions(+), 5 deletions(-) |
| |
| diff --git a/net/can/af_can.c b/net/can/af_can.c |
| index 1201846dc07e3..b3edb80921248 100644 |
| --- a/net/can/af_can.c |
| +++ b/net/can/af_can.c |
| @@ -748,16 +748,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, |
| { |
| struct canfd_frame *cfd = (struct canfd_frame *)skb->data; |
| |
| - if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU || |
| - cfd->len > CANFD_MAX_DLEN)) { |
| - pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n", |
| + if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) { |
| + pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n", |
| + dev->type, skb->len); |
| + goto free_skb; |
| + } |
| + |
| + /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */ |
| + if (unlikely(cfd->len > CANFD_MAX_DLEN)) { |
| + pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n", |
| dev->type, skb->len, cfd->len); |
| - kfree_skb(skb); |
| - return NET_RX_DROP; |
| + goto free_skb; |
| } |
| |
| can_receive(skb, dev); |
| return NET_RX_SUCCESS; |
| + |
| +free_skb: |
| + kfree_skb(skb); |
| + return NET_RX_DROP; |
| } |
| |
| /* |
| -- |
| 2.27.0 |
| |