On 2021/10/22 18:23, Oleksij Rempel wrote: > On Thu, Oct 21, 2021 at 10:04:16PM +0800, Zhang Changzhong wrote: >> According to SAE-J1939-82 2015 (A.3.6 Row 2), a receiver should never >> send TP.CM_CTS to the global address, so we can add a check in >> j1939_can_recv() to drop messages with invalid source address. >> >> Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") >> Signed-off-by: Zhang Changzhong <zhangchangzhong@xxxxxxxxxx> > > NACK. This will break Address Claiming, where first message is SA == 0xff I know that 0xfe can be used as a source address, but which message has a source address of 0xff? According to SAE-J1939-81 2017 4.2.2.8: The network address 255, also known as the Global address, is permitted in the Destination Address field of the SAE J1939 message identifier but never in the Source Address field. > >> --- >> net/can/j1939/main.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c >> index 08c8606..4f1e4bb 100644 >> --- a/net/can/j1939/main.c >> +++ b/net/can/j1939/main.c >> @@ -75,6 +75,10 @@ static void j1939_can_recv(struct sk_buff *iskb, void *data) >> skcb->addr.pgn = (cf->can_id >> 8) & J1939_PGN_MAX; >> /* set default message type */ >> skcb->addr.type = J1939_TP; >> + if (!j1939_address_is_valid(skcb->addr.sa)) >> + /* ignore messages whose sa is broadcast address */ >> + goto done; >> + >> if (j1939_pgn_is_pdu1(skcb->addr.pgn)) { >> /* Type 1: with destination address */ >> skcb->addr.da = skcb->addr.pgn; >> -- >> 2.9.5 >> >> >> >