Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp4290808pxb; Thu, 14 Oct 2021 02:17:20 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwaHJHXu1uK3NdB7n7GQLkCCJy7/PdC2o9tETg+wQXhaoKeTBQW0y2yV0+WJ9/I9bMBqUfZ X-Received: by 2002:a63:a80c:: with SMTP id o12mr3321682pgf.422.1634203040120; Thu, 14 Oct 2021 02:17:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1634203040; cv=none; d=google.com; s=arc-20160816; b=xrVCmtAn8GgPGCYsKBbPVHOMShRcspiS0iG+3v3mpbaeC1ZglhlFo3U3Irv7lmywIr 920tvNwSPCVUNhhhz7ffA7m7hDVCPWOi0/81xqP6GziZO9mGM/tJfTd5A+6LEPDmUU6M MgDDzI4t6hLgSCV0Su90puXCmLV3K09PjObz84obTguP2ZNW0MMl0ctJfcRu/axyASsC D13lBdoKslpFRWPSjcQGWclfJ3UFKdb7RwfiAQVxXR1o6nmZu94jhAfS/C2DXLhLp0OM kbtLRO9kOxEO4YNTGaQh0BVbJAnG9BWBbChIiUkHYG6woENMPYFKb8s4HF+U0MtJGYPD srSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from; bh=3nL745ZbHSZwQNvMU0EhW+pVsy+Z0b3P1b/CDUgeeOY=; b=utLNw/ZsdNMZ5bgWceexsUq6yBzFKgHqddnvIEmlw8YC98fH708ACl6McT0414GIuX PvA7xDibeTejCDnKrckwbMPmDdOIbp6NknsSGdKBQ8f+b1Smr7hucHGFvAdvkx6n37Hh TSzzimB+e4JmvP5qWr2xmk08xjouQ/FDRR52uP0xIOw8qGXA5uvlMyN+gzeK/KGmUGEx gXqxHQ9j2MvyORnnUh8QV5RA+QWY7cP0E7aga0C2AAgZ4gdsioQSQGrYdgxkyClfZ9mb 9P9+r4lbUiO09//L5OQuCIIHMml1h0a84bGacbWyhn44n6M3Jc+9TRb2zyebaO3K6mfJ Nvng== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id bi7si2682912plb.71.2021.10.14.02.17.06; Thu, 14 Oct 2021 02:17:20 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230007AbhJNJSN (ORCPT + 99 others); Thu, 14 Oct 2021 05:18:13 -0400 Received: from szxga01-in.huawei.com ([45.249.212.187]:28939 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229551AbhJNJSM (ORCPT ); Thu, 14 Oct 2021 05:18:12 -0400 Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4HVNtx19Kdzbn9S; Thu, 14 Oct 2021 17:11:37 +0800 (CST) Received: from dggpeml500006.china.huawei.com (7.185.36.76) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.8; Thu, 14 Oct 2021 17:16:05 +0800 Received: from compute.localdomain (10.175.112.70) by dggpeml500006.china.huawei.com (7.185.36.76) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.8; Thu, 14 Oct 2021 17:16:04 +0800 From: Zhang Changzhong To: Robin van der Gracht , Oleksij Rempel , , Oliver Hartkopp , Marc Kleine-Budde , "David S. Miller" , Jakub Kicinski , "Kurt Van Dijck" , Maxime Jayat CC: Zhang Changzhong , , , Subject: [PATCH net] can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes Date: Thu, 14 Oct 2021 17:26:40 +0800 Message-ID: <1634203601-3460-1-git-send-email-zhangchangzhong@huawei.com> X-Mailer: git-send-email 1.8.3.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.112.70] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To dggpeml500006.china.huawei.com (7.185.36.76) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The receiver should abort TP if 'total message size' in TP.CM_RTS and TP.CM_BAM is less than 9 or greater than 1785 [1], but currently the j1939 stack only checks the upper bound and the receiver will accept the following broadcast message: vcan1 18ECFF00 [8] 20 08 00 02 FF 00 23 01 vcan1 18EBFF00 [8] 01 00 00 00 00 00 00 00 vcan1 18EBFF00 [8] 02 00 FF FF FF FF FF FF This patch adds check for the lower bound and abort illegal TP. [1] SAE-J1939-82 A.3.4 Row 2 and A.3.6 Row 6. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Zhang Changzhong --- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/transport.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h index f6df208..16af1a7 100644 --- a/net/can/j1939/j1939-priv.h +++ b/net/can/j1939/j1939-priv.h @@ -330,6 +330,7 @@ int j1939_session_activate(struct j1939_session *session); void j1939_tp_schedule_txtimer(struct j1939_session *session, int msec); void j1939_session_timers_cancel(struct j1939_session *session); +#define J1939_MIN_TP_PACKET_SIZE 9 #define J1939_MAX_TP_PACKET_SIZE (7 * 0xff) #define J1939_MAX_ETP_PACKET_SIZE (7 * 0x00ffffff) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index bb5c4b8..b685d31 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1609,6 +1609,8 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, abort = J1939_XTP_ABORT_FAULT; else if (len > priv->tp_max_packet_size) abort = J1939_XTP_ABORT_RESOURCE; + else if (len < J1939_MIN_TP_PACKET_SIZE) + abort = J1939_XTP_ABORT_FAULT; } if (abort != J1939_XTP_NO_ABORT) { -- 2.9.5