diff options
| author | Oleksij Rempel <o.rempel@pengutronix.de> | 2019-10-25 15:04:13 +0200 |
|---|---|---|
| committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2019-11-04 21:47:23 +0100 |
| commit | 688d11c38423fd98ab6c8d5fc1976c8f365fc875 (patch) | |
| tree | 0d28fc8b61d1e3a0f547107450ad6ff6e54c9eef /net/can | |
| parent | eaa654f164ba9acd5656e6485eeb5e73da8bfc3e (diff) | |
| download | linux-688d11c38423fd98ab6c8d5fc1976c8f365fc875.tar.gz linux-688d11c38423fd98ab6c8d5fc1976c8f365fc875.tar.bz2 linux-688d11c38423fd98ab6c8d5fc1976c8f365fc875.zip | |
can: j1939: transport: j1939_xtp_rx_eoma_one(): Add sanity check for correct total message size
We were sending malformed EOMA with total message size set to 0. This
issue has been fixed in the previous patch.
In this patch a sanity check is added to the RX path and a error message
is displayed.
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'net/can')
| -rw-r--r-- | net/can/j1939/transport.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 06183d6f4fb7..e5f1a56994c6 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1273,9 +1273,27 @@ j1939_xtp_rx_abort(struct j1939_priv *priv, struct sk_buff *skb, static void j1939_xtp_rx_eoma_one(struct j1939_session *session, struct sk_buff *skb) { + struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb); + const u8 *dat; + int len; + if (j1939_xtp_rx_cmd_bad_pgn(session, skb)) return; + dat = skb->data; + + if (skcb->addr.type == J1939_ETP) + len = j1939_etp_ctl_to_size(dat); + else + len = j1939_tp_ctl_to_size(dat); + + if (session->total_message_size != len) { + netdev_warn_once(session->priv->ndev, + "%s: 0x%p: Incorrect size. Expected: %i; got: %i.\n", + __func__, session, session->total_message_size, + len); + } + netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session); session->pkt.tx_acked = session->pkt.total; |