Commit 395d988f authored by Marc Kleine-Budde's avatar Marc Kleine-Budde
Browse files

can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data 

The URB received in gs_usb_receive_bulk_callback() contains a struct
gs_host_frame. The length of the data after the header depends on the
gs_host_frame hf::flags and the active device features (e.g. time
stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have
at least received the required amount of data before accessing it. Only
copy the data to that skb that has actually been received.

Fixes: d08e973a ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-3-a29b42eacada@pengutronix.de


[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 6fe9f327

drivers/net/can/usb/gs_usb.c

+54 −5
Original line number Diff line number Diff line
@@ -261,6 +261,11 @@ struct canfd_quirk { 
	u8 quirk;

} __packed;



/* struct gs_host_frame::echo_id == GS_HOST_FRAME_ECHO_ID_RX indicates

 * a regular RX'ed CAN frame

 */

#define GS_HOST_FRAME_ECHO_ID_RX 0xffffffff



struct gs_host_frame {

	struct_group(header,

		u32 echo_id;
@@ -570,6 +575,37 @@ gs_usb_get_echo_skb(struct gs_can *dev, struct sk_buff *skb, 
	return len;

}



static unsigned int

gs_usb_get_minimum_rx_length(const struct gs_can *dev, const struct gs_host_frame *hf,

			     unsigned int *data_length_p)

{

	unsigned int minimum_length, data_length = 0;



	if (hf->flags & GS_CAN_FLAG_FD) {

		if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX)

			data_length = can_fd_dlc2len(hf->can_dlc);



		if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)

			/* timestamp follows data field of max size */

			minimum_length = struct_size(hf, canfd_ts, 1);

		else

			minimum_length = sizeof(hf->header) + data_length;

	} else {

		if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX &&

		    !(hf->can_id & cpu_to_le32(CAN_RTR_FLAG)))

			data_length = can_cc_dlc2len(hf->can_dlc);



		if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)

			/* timestamp follows data field of max size */

			minimum_length = struct_size(hf, classic_can_ts, 1);

		else

			minimum_length = sizeof(hf->header) + data_length;

	}



	*data_length_p = data_length;

	return minimum_length;

}



static void gs_usb_receive_bulk_callback(struct urb *urb)

{

	struct gs_usb *parent = urb->context;
@@ -578,7 +614,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) 
	int rc;

	struct net_device_stats *stats;

	struct gs_host_frame *hf = urb->transfer_buffer;

	unsigned int minimum_length;

	unsigned int minimum_length, data_length;

	struct gs_tx_context *txc;

	struct can_frame *cf;

	struct canfd_frame *cfd;
@@ -621,20 +657,33 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) 
	if (!netif_running(netdev))

		goto resubmit_urb;



	if (hf->echo_id == -1) { /* normal rx */

	minimum_length = gs_usb_get_minimum_rx_length(dev, hf, &data_length);

	if (urb->actual_length < minimum_length) {

		stats->rx_errors++;

		stats->rx_length_errors++;



		if (net_ratelimit())

			netdev_err(netdev,

				   "short read (actual_length=%u, minimum_length=%u)\n",

				   urb->actual_length, minimum_length);



		goto resubmit_urb;

	}



	if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX) { /* normal rx */

		if (hf->flags & GS_CAN_FLAG_FD) {

			skb = alloc_canfd_skb(netdev, &cfd);

			if (!skb)

				return;



			cfd->can_id = le32_to_cpu(hf->can_id);

			cfd->len = can_fd_dlc2len(hf->can_dlc);

			cfd->len = data_length;

			if (hf->flags & GS_CAN_FLAG_BRS)

				cfd->flags |= CANFD_BRS;

			if (hf->flags & GS_CAN_FLAG_ESI)

				cfd->flags |= CANFD_ESI;



			memcpy(cfd->data, hf->canfd->data, cfd->len);

			memcpy(cfd->data, hf->canfd->data, data_length);

		} else {

			skb = alloc_can_skb(netdev, &cf);

			if (!skb)
@@ -643,7 +692,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) 
			cf->can_id = le32_to_cpu(hf->can_id);

			can_frame_set_cc_len(cf, hf->can_dlc, dev->can.ctrlmode);



			memcpy(cf->data, hf->classic_can->data, 8);

			memcpy(cf->data, hf->classic_can->data, data_length);



			/* ERROR frames tell us information about the controller */

			if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)