github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-28 00:53:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data

Browse Source 
The URB received in gs_usb_receive_bulk_callback() contains a struct
gs_host_frame. The length of the data after the header depends on the
gs_host_frame hf::flags and the active device features (e.g. time
stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have
at least received the required amount of data before accessing it. Only
copy the data to that skb that has actually been received.

Fixes: d08e973a77 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-3-a29b42eacada@pengutronix.de
[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This commit is contained in:
Marc Kleine-Budde 2025-11-08 10:01:03 +01:00
parent 6fe9f3279f
commit 395d988f93
1 changed files with 54 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
drivers/net/can/usb/gs_usb.c
View File

@ -261,6 +261,11 @@ struct canfd_quirk {
u8 quirk;
} __packed;
/* struct gs_host_frame::echo_id == GS_HOST_FRAME_ECHO_ID_RX indicates
* a regular RX'ed CAN frame
*/
#define GS_HOST_FRAME_ECHO_ID_RX 0xffffffff
struct gs_host_frame {
struct_group(header,
u32 echo_id;
@ -570,6 +575,37 @@ gs_usb_get_echo_skb(struct gs_can *dev, struct sk_buff *skb,
return len;
}
static unsigned int
gs_usb_get_minimum_rx_length(const struct gs_can *dev, const struct gs_host_frame *hf,
unsigned int *data_length_p)
{
unsigned int minimum_length, data_length = 0;
if (hf->flags & GS_CAN_FLAG_FD) {
if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX)
data_length = can_fd_dlc2len(hf->can_dlc);
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
/* timestamp follows data field of max size */
minimum_length = struct_size(hf, canfd_ts, 1);
else
minimum_length = sizeof(hf->header) + data_length;
} else {
if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX &&
!(hf->can_id & cpu_to_le32(CAN_RTR_FLAG)))
data_length = can_cc_dlc2len(hf->can_dlc);
if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
/* timestamp follows data field of max size */
minimum_length = struct_size(hf, classic_can_ts, 1);
else
minimum_length = sizeof(hf->header) + data_length;
}
*data_length_p = data_length;
return minimum_length;
}
static void gs_usb_receive_bulk_callback(struct urb *urb)
{
struct gs_usb *parent = urb->context;
@ -578,7 +614,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
int rc;
struct net_device_stats *stats;
struct gs_host_frame *hf = urb->transfer_buffer;
unsigned int minimum_length;
unsigned int minimum_length, data_length;
struct gs_tx_context *txc;
struct can_frame *cf;
struct canfd_frame *cfd;
@ -621,20 +657,33 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
if (!netif_running(netdev))
goto resubmit_urb;
if (hf->echo_id == -1) { /* normal rx */
minimum_length = gs_usb_get_minimum_rx_length(dev, hf, &data_length);
if (urb->actual_length < minimum_length) {
stats->rx_errors++;
stats->rx_length_errors++;
if (net_ratelimit())
netdev_err(netdev,
"short read (actual_length=%u, minimum_length=%u)\n",
urb->actual_length, minimum_length);
goto resubmit_urb;
}
if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX) { /* normal rx */
if (hf->flags & GS_CAN_FLAG_FD) {
skb = alloc_canfd_skb(netdev, &cfd);
if (!skb)
return;
cfd->can_id = le32_to_cpu(hf->can_id);
cfd->len = can_fd_dlc2len(hf->can_dlc);
cfd->len = data_length;
if (hf->flags & GS_CAN_FLAG_BRS)
cfd->flags |= CANFD_BRS;
if (hf->flags & GS_CAN_FLAG_ESI)
cfd->flags |= CANFD_ESI;
memcpy(cfd->data, hf->canfd->data, cfd->len);
memcpy(cfd->data, hf->canfd->data, data_length);
} else {
skb = alloc_can_skb(netdev, &cf);
if (!skb)
@ -643,7 +692,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
cf->can_id = le32_to_cpu(hf->can_id);
can_frame_set_cc_len(cf, hf->can_dlc, dev->can.ctrlmode);
memcpy(cf->data, hf->classic_can->data, 8);
memcpy(cf->data, hf->classic_can->data, data_length);
/* ERROR frames tell us information about the controller */
if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)