git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 8302d2990a1172bb218bd6a598050d831c161225 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Thu, 13 Aug 2020 17:06:04 +0300
   4 Subject: can: peak_usb: add range checking in decode operations
   5
   6 From: Dan Carpenter <dan.carpenter@oracle.com>
   7
   8 [ Upstream commit a6921dd524fe31d1f460c161d3526a407533b6db ]
   9
  10 These values come from skb->data so Smatch considers them untrusted.  I
  11 believe Smatch is correct but I don't have a way to test this.
  12
  13 The usb_if->dev[] array has 2 elements but the index is in the 0-15
  14 range without checks.  The cfd->len can be up to 255 but the maximum
  15 valid size is CANFD_MAX_DLEN (64) so that could lead to memory
  16 corruption.
  17
  18 Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
  19 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  20 Link: https://lore.kernel.org/r/20200813140604.GA456946@mwanda
  21 Acked-by: Stephane Grosjean <s.grosjean@peak-system.com>
  22 Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
  23 Signed-off-by: Sasha Levin <sashal@kernel.org>
  24 ---
  25  drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 48 +++++++++++++++++-----
  26  1 file changed, 37 insertions(+), 11 deletions(-)
  27
  28 diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
  29 index 47cc1ff5b88e8..dee3e689b54da 100644
  30 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
  31 +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
  32 @@ -468,12 +468,18 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if,
  33                                      struct pucan_msg *rx_msg)
  34  {
  35         struct pucan_rx_msg *rm = (struct pucan_rx_msg *)rx_msg;
  36 -       struct peak_usb_device *dev = usb_if->dev[pucan_msg_get_channel(rm)];
  37 -       struct net_device *netdev = dev->netdev;
  38 +       struct peak_usb_device *dev;
  39 +       struct net_device *netdev;
  40         struct canfd_frame *cfd;
  41         struct sk_buff *skb;
  42         const u16 rx_msg_flags = le16_to_cpu(rm->flags);
  43
  44 +       if (pucan_msg_get_channel(rm) >= ARRAY_SIZE(usb_if->dev))
  45 +               return -ENOMEM;
  46 +
  47 +       dev = usb_if->dev[pucan_msg_get_channel(rm)];
  48 +       netdev = dev->netdev;
  49 +
  50         if (rx_msg_flags & PUCAN_MSG_EXT_DATA_LEN) {
  51                 /* CANFD frame case */
  52                 skb = alloc_canfd_skb(netdev, &cfd);
  53 @@ -519,15 +525,21 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
  54                                      struct pucan_msg *rx_msg)
  55  {
  56         struct pucan_status_msg *sm = (struct pucan_status_msg *)rx_msg;
  57 -       struct peak_usb_device *dev = usb_if->dev[pucan_stmsg_get_channel(sm)];
  58 -       struct pcan_usb_fd_device *pdev =
  59 -                       container_of(dev, struct pcan_usb_fd_device, dev);
  60 +       struct pcan_usb_fd_device *pdev;
  61         enum can_state new_state = CAN_STATE_ERROR_ACTIVE;
  62         enum can_state rx_state, tx_state;
  63 -       struct net_device *netdev = dev->netdev;
  64 +       struct peak_usb_device *dev;
  65 +       struct net_device *netdev;
  66         struct can_frame *cf;
  67         struct sk_buff *skb;
  68
  69 +       if (pucan_stmsg_get_channel(sm) >= ARRAY_SIZE(usb_if->dev))
  70 +               return -ENOMEM;
  71 +
  72 +       dev = usb_if->dev[pucan_stmsg_get_channel(sm)];
  73 +       pdev = container_of(dev, struct pcan_usb_fd_device, dev);
  74 +       netdev = dev->netdev;
  75 +
  76         /* nothing should be sent while in BUS_OFF state */
  77         if (dev->can.state == CAN_STATE_BUS_OFF)
  78                 return 0;
  79 @@ -579,9 +591,14 @@ static int pcan_usb_fd_decode_error(struct pcan_usb_fd_if *usb_if,
  80                                     struct pucan_msg *rx_msg)
  81  {
  82         struct pucan_error_msg *er = (struct pucan_error_msg *)rx_msg;
  83 -       struct peak_usb_device *dev = usb_if->dev[pucan_ermsg_get_channel(er)];
  84 -       struct pcan_usb_fd_device *pdev =
  85 -                       container_of(dev, struct pcan_usb_fd_device, dev);
  86 +       struct pcan_usb_fd_device *pdev;
  87 +       struct peak_usb_device *dev;
  88 +
  89 +       if (pucan_ermsg_get_channel(er) >= ARRAY_SIZE(usb_if->dev))
  90 +               return -EINVAL;
  91 +
  92 +       dev = usb_if->dev[pucan_ermsg_get_channel(er)];
  93 +       pdev = container_of(dev, struct pcan_usb_fd_device, dev);
  94
  95         /* keep a trace of tx and rx error counters for later use */
  96         pdev->bec.txerr = er->tx_err_cnt;
  97 @@ -595,11 +612,17 @@ static int pcan_usb_fd_decode_overrun(struct pcan_usb_fd_if *usb_if,
  98                                       struct pucan_msg *rx_msg)
  99  {
 100         struct pcan_ufd_ovr_msg *ov = (struct pcan_ufd_ovr_msg *)rx_msg;
 101 -       struct peak_usb_device *dev = usb_if->dev[pufd_omsg_get_channel(ov)];
 102 -       struct net_device *netdev = dev->netdev;
 103 +       struct peak_usb_device *dev;
 104 +       struct net_device *netdev;
 105         struct can_frame *cf;
 106         struct sk_buff *skb;
 107
 108 +       if (pufd_omsg_get_channel(ov) >= ARRAY_SIZE(usb_if->dev))
 109 +               return -EINVAL;
 110 +
 111 +       dev = usb_if->dev[pufd_omsg_get_channel(ov)];
 112 +       netdev = dev->netdev;
 113 +
 114         /* allocate an skb to store the error frame */
 115         skb = alloc_can_err_skb(netdev, &cf);
 116         if (!skb)
 117 @@ -716,6 +739,9 @@ static int pcan_usb_fd_encode_msg(struct peak_usb_device *dev,
 118         u16 tx_msg_size, tx_msg_flags;
 119         u8 can_dlc;
 120
 121 +       if (cfd->len > CANFD_MAX_DLEN)
 122 +               return -EINVAL;
 123 +
 124         tx_msg_size = ALIGN(sizeof(struct pucan_tx_msg) + cfd->len, 4);
 125         tx_msg->size = cpu_to_le16(tx_msg_size);
 126         tx_msg->type = cpu_to_le16(PUCAN_MSG_CAN_TX);
 127 --
 128 2.27.0
 129