Patch "can: isotp: tx-path: zero initialize outgoing CAN frames" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    can: isotp: tx-path: zero initialize outgoing CAN frames

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     can-isotp-tx-path-zero-initialize-outgoing-can-frame.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b6d94f765f3508baff0eb7c8fa596689da113621
Author: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
Date:   Fri Mar 19 11:06:19 2021 +0100

    can: isotp: tx-path: zero initialize outgoing CAN frames
    
    [ Upstream commit b5f020f82a8e41201c6ede20fa00389d6980b223 ]
    
    Commit d4eb538e1f48 ("can: isotp: TX-path: ensure that CAN frame flags are
    initialized") ensured the TX flags to be properly set for outgoing CAN
    frames.
    
    In fact the root cause of the issue results from a missing initialization
    of outgoing CAN frames created by isotp. This is no problem on the CAN bus
    as the CAN driver only picks the correctly defined content from the struct
    can(fd)_frame. But when the outgoing frames are monitored (e.g. with
    candump) we potentially leak some bytes in the unused content of
    struct can(fd)_frame.
    
    Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
    Cc: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20210319100619.10858-1-socketcan@xxxxxxxxxxxx
    Signed-off-by: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
    Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/can/isotp.c b/net/can/isotp.c
index b01662d2f2cd..ea1e227b8e54 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -196,7 +196,7 @@ static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus)
 	nskb->dev = dev;
 	can_skb_set_owner(nskb, sk);
 	ncf = (struct canfd_frame *)nskb->data;
-	skb_put(nskb, so->ll.mtu);
+	skb_put_zero(nskb, so->ll.mtu);
 
 	/* create & send flow control reply */
 	ncf->can_id = so->txid;
@@ -779,7 +779,7 @@ isotp_tx_burst:
 		can_skb_prv(skb)->skbcnt = 0;
 
 		cf = (struct canfd_frame *)skb->data;
-		skb_put(skb, so->ll.mtu);
+		skb_put_zero(skb, so->ll.mtu);
 
 		/* create consecutive frame */
 		isotp_fill_dataframe(cf, so, ae, 0);
@@ -887,7 +887,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	so->tx.idx = 0;
 
 	cf = (struct canfd_frame *)skb->data;
-	skb_put(skb, so->ll.mtu);
+	skb_put_zero(skb, so->ll.mtu);
 
 	/* take care of a potential SF_DL ESC offset for TX_DL > 8 */
 	off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0;