From: Greg Kroah-Hartman Date: Fri, 3 Dec 2021 10:32:24 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.294~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bb2f7a472ca307bfec8fc52ae263c94172843e90;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: can-j1939-j1939_tp_cmd_recv-check-the-dst-address-of-tp.cm_bam.patch --- diff --git a/queue-5.4/can-j1939-j1939_tp_cmd_recv-check-the-dst-address-of-tp.cm_bam.patch b/queue-5.4/can-j1939-j1939_tp_cmd_recv-check-the-dst-address-of-tp.cm_bam.patch new file mode 100644 index 00000000000..df19b7201da --- /dev/null +++ b/queue-5.4/can-j1939-j1939_tp_cmd_recv-check-the-dst-address-of-tp.cm_bam.patch @@ -0,0 +1,46 @@ +From 164051a6ab5445bd97f719f50b16db8b32174269 Mon Sep 17 00:00:00 2001 +From: Zhang Changzhong +Date: Thu, 28 Oct 2021 22:38:27 +0800 +Subject: can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM + +From: Zhang Changzhong + +commit 164051a6ab5445bd97f719f50b16db8b32174269 upstream. + +The TP.CM_BAM message must be sent to the global address [1], so add a +check to drop TP.CM_BAM sent to a non-global address. + +Without this patch, the receiver will treat the following packets as +normal RTS/CTS transport: +18EC0102#20090002FF002301 +18EB0102#0100000000000000 +18EB0102#020000FFFFFFFFFF + +[1] SAE-J1939-82 2015 A.3.3 Row 1. + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Link: https://lore.kernel.org/all/1635431907-15617-4-git-send-email-zhangchangzhong@huawei.com +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Changzhong +Acked-by: Oleksij Rempel +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -2004,6 +2004,12 @@ static void j1939_tp_cmd_recv(struct j19 + extd = J1939_ETP; + /* fall through */ + case J1939_TP_CMD_BAM: /* fall through */ ++ if (cmd == J1939_TP_CMD_BAM && !j1939_cb_is_broadcast(skcb)) { ++ netdev_err_once(priv->ndev, "%s: BAM to unicast (%02x), ignoring!\n", ++ __func__, skcb->addr.sa); ++ return; ++ } ++ fallthrough; + case J1939_TP_CMD_RTS: /* fall through */ + if (skcb->addr.type != extd) + return; diff --git a/queue-5.4/series b/queue-5.4/series index 69134cc60e3..bd00494f6d2 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1,3 +1,4 @@ nfsv42-fix-pagecache-invalidation-after-copy-clone.patch of-clk-make-linux-of_clk.h-self-contained.patch arm64-dts-mcbin-support-2w-sfp-modules.patch +can-j1939-j1939_tp_cmd_recv-check-the-dst-address-of-tp.cm_bam.patch