summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorMarc Kleine-Budde <mkl@pengutronix.de>2022-01-05 14:01:12 +0100
committerMarc Kleine-Budde <mkl@pengutronix.de>2022-01-05 21:49:47 +0100
commit5f33a09e769a9da0482f20a6770a342842443776 (patch)
tree73823b454d66df7ecec4f32111df2905e5ec3528 /net
parent4a8737ff068724f509d583fef404d349adba80d6 (diff)
downloadlinux-5f33a09e769a9da0482f20a6770a342842443776.tar.bz2
can: isotp: convert struct tpcon::{idx,len} to unsigned int
In isotp_rcv_ff() 32 bit of data received over the network is assigned to struct tpcon::len. Later in that function the length is checked for the maximal supported length against MAX_MSG_LENGTH. As struct tpcon::len is an "int" this check does not work, if the provided length overflows the "int". Later on struct tpcon::idx is compared against struct tpcon::len. To fix this problem this patch converts both struct tpcon::{idx,len} to unsigned int. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/20220105132429.1170627-1-mkl@pengutronix.de Cc: stable@vger.kernel.org Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'net')
-rw-r--r--net/can/isotp.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/can/isotp.c b/net/can/isotp.c
index df6968b28bf4..02cbcb2ecf0d 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -119,8 +119,8 @@ enum {
};
struct tpcon {
- int idx;
- int len;
+ unsigned int idx;
+ unsigned int len;
u32 state;
u8 bs;
u8 sn;