Commit 69c4a65e authored by David S. Miller's avatar David S. Miller

Merge tag 'linux-can-fixes-for-4.15-20180118' of...

Merge tag 'linux-can-fixes-for-4.15-20180118' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2018-01-18

====================
this is a pull reqeust of two patches for net/master:

The syzkaller project triggered two WARN_ONCE() in the af_can code from
userspace and we decided to replace it by a pr_warn_once().
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 591ff9ea d4689846
...@@ -721,20 +721,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, ...@@ -721,20 +721,16 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
{ {
struct canfd_frame *cfd = (struct canfd_frame *)skb->data; struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
if (WARN_ONCE(dev->type != ARPHRD_CAN || if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
skb->len != CAN_MTU || cfd->len > CAN_MAX_DLEN)) {
cfd->len > CAN_MAX_DLEN, pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
"PF_CAN: dropped non conform CAN skbuf: " dev->type, skb->len, cfd->len);
"dev type %d, len %d, datalen %d\n", kfree_skb(skb);
dev->type, skb->len, cfd->len)) return NET_RX_DROP;
goto drop; }
can_receive(skb, dev); can_receive(skb, dev);
return NET_RX_SUCCESS; return NET_RX_SUCCESS;
drop:
kfree_skb(skb);
return NET_RX_DROP;
} }
static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
...@@ -742,20 +738,16 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, ...@@ -742,20 +738,16 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
{ {
struct canfd_frame *cfd = (struct canfd_frame *)skb->data; struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
if (WARN_ONCE(dev->type != ARPHRD_CAN || if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
skb->len != CANFD_MTU || cfd->len > CANFD_MAX_DLEN)) {
cfd->len > CANFD_MAX_DLEN, pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
"PF_CAN: dropped non conform CAN FD skbuf: " dev->type, skb->len, cfd->len);
"dev type %d, len %d, datalen %d\n", kfree_skb(skb);
dev->type, skb->len, cfd->len)) return NET_RX_DROP;
goto drop; }
can_receive(skb, dev); can_receive(skb, dev);
return NET_RX_SUCCESS; return NET_RX_SUCCESS;
drop:
kfree_skb(skb);
return NET_RX_DROP;
} }
/* /*
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment