This is a note to let you know that I've just added the patch titled
can: isotp: convert struct tpcon::{idx,len} to unsigned int
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
can-isotp-convert-struct-tpcon-idx-len-to-unsigned-int.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5f33a09e769a9da0482f20a6770a342842443776 Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
Date: Wed, 5 Jan 2022 14:01:12 +0100
Subject: can: isotp: convert struct tpcon::{idx,len} to unsigned int
From: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
commit 5f33a09e769a9da0482f20a6770a342842443776 upstream.
In isotp_rcv_ff() 32 bit of data received over the network is assigned
to struct tpcon::len. Later in that function the length is checked for
the maximal supported length against MAX_MSG_LENGTH.
As struct tpcon::len is an "int" this check does not work, if the
provided length overflows the "int".
Later on struct tpcon::idx is compared against struct tpcon::len.
To fix this problem this patch converts both struct tpcon::{idx,len}
to unsigned int.
Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/20220105132429.1170627-1-mkl@xxxxxxxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Acked-by: Oliver Hartkopp <socketcan@xxxxxxxxxxxx>
Reported-by: syzbot+4c63f36709a642f801c5@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/can/isotp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -119,8 +119,8 @@ enum {
};
struct tpcon {
- int idx;
- int len;
+ unsigned int idx;
+ unsigned int len;
u32 state;
u8 bs;
u8 sn;
Patches currently in stable-queue which might be from mkl@xxxxxxxxxxxxxx are
queue-5.10/can-isotp-convert-struct-tpcon-idx-len-to-unsigned-int.patch
queue-5.10/can-gs_usb-fix-use-of-uninitialized-variable-detach-device-on-reception-of-invalid-usb-data.patch
queue-5.10/can-gs_usb-gs_can_start_xmit-zero-initialize-hf-flags-reserved.patch
