diff options
| author | Marc Kleine-Budde <mkl@pengutronix.de> | 2022-01-05 16:01:12 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-01-16 11:12:44 +0300 |
| commit | 1079b56de4af202d63ff769cf2d21491a595c9a5 (patch) | |
| tree | c95ad3a0550212e16dbeb7af30346d15f22d792c /net/can | |
| parent | 1026f710bd558147d50131cc9bbdd4844d3245e1 (diff) | |
| download | linux-1079b56de4af202d63ff769cf2d21491a595c9a5.tar.xz | |
can: isotp: convert struct tpcon::{idx,len} to unsigned int
commit 5f33a09e769a9da0482f20a6770a342842443776 upstream.
In isotp_rcv_ff() 32 bit of data received over the network is assigned
to struct tpcon::len. Later in that function the length is checked for
the maximal supported length against MAX_MSG_LENGTH.
As struct tpcon::len is an "int" this check does not work, if the
provided length overflows the "int".
Later on struct tpcon::idx is compared against struct tpcon::len.
To fix this problem this patch converts both struct tpcon::{idx,len}
to unsigned int.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/20220105132429.1170627-1-mkl@pengutronix.de
Cc: stable@vger.kernel.org
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/can')
| -rw-r--r-- | net/can/isotp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/can/isotp.c b/net/can/isotp.c index df6968b28bf4..02cbcb2ecf0d 100644 --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -119,8 +119,8 @@ enum { }; struct tpcon { - int idx; - int len; + unsigned int idx; + unsigned int len; u32 state; u8 bs; u8 sn; |