Anant Thazhemadam 247b03eca2 can: af_can: prevent potential access of uninitialized member in canfd_rcv() ... [ Upstream commit 9aa9379d8f ] In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this uninitialized cfd->len is accessed nonetheless by pr_warn_once(). Fix this uninitialized variable access by checking cfd->len's validity condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's condition is checked, and appropriately modify the log messages that are generated as well. In case either of the required conditions fail, the skb is freed and NET_RX_DROP is returned, same as before. Fixes: d468984688 ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once") Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-11-24 13:29:05 +01:00
..
j1939	can: j1939: j1939_sk_bind(): return failure if netdev is down	2020-11-18 19:20:19 +01:00
Kconfig	can: add support of SAE J1939 protocol	2019-09-04 14:22:33 +02:00
Makefile	can: add support of SAE J1939 protocol	2019-09-04 14:22:33 +02:00
af_can.c	can: af_can: prevent potential access of uninitialized member in canfd_rcv()	2020-11-24 13:29:05 +01:00
af_can.h	can: introduce CAN midlayer private and allocate it automatically	2019-09-04 13:29:14 +02:00
bcm.c	can: introduce CAN_REQUIRED_SIZE macro	2019-09-04 13:29:15 +02:00
gw.c	can: gw: add support for CAN FD frames	2019-08-13 17:32:21 +02:00
proc.c	can: proc: can_remove_proc(): silence remove_proc_entry warning	2020-11-22 10:14:12 +01:00
raw.c	can: introduce CAN_REQUIRED_SIZE macro	2019-09-04 13:29:15 +02:00