Anant Thazhemadam e2b9ee9fe6 can: af_can: prevent potential access of uninitialized member in canfd_rcv() ... [ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ] In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this uninitialized cfd->len is accessed nonetheless by pr_warn_once(). Fix this uninitialized variable access by checking cfd->len's validity condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's condition is checked, and appropriately modify the log messages that are generated as well. In case either of the required conditions fail, the skb is freed and NET_RX_DROP is returned, same as before. Fixes: d468984688 ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once") Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-11-24 13:27:22 +01:00
..
af_can.c	can: af_can: prevent potential access of uninitialized member in canfd_rcv()	2020-11-24 13:27:22 +01:00
af_can.h	can: af_can: give struct holding the CAN per device receive lists a sensible name	2018-01-05 11:12:08 +01:00
bcm.c	can: bcm: check timer values before ktime conversion	2019-01-31 08:14:39 +01:00
gw.c	can: gw: Fix error path of cgw_module_init	2019-08-29 08:28:30 +02:00
Kconfig	can: migrate documentation to restructured text	2018-01-26 10:46:44 +01:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
proc.c	can: proc: can_remove_proc(): silence remove_proc_entry warning	2020-11-22 10:02:26 +01:00
raw.c	can: raw: check for CAN FD capable netdev in raw_sendmsg()	2018-12-01 09:37:30 +01:00