can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing...

The URB received in gs_usb_receive_bulk_callback() contains a struct
gs_host_frame. The length of the data after the header depends on the
gs_host_frame hf::flags and the active device features (e.g. time
stamping).

Introduce a new function gs_usb_get_minimum_length() and check that we have
at least received the required amount of data before accessing it. Only
copy the data to that skb that has actually been received.

Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-3-a29b42eacada@pengutronix.de
[mkl: rename gs_usb_get_minimum_length() -> +gs_usb_get_minimum_rx_length()]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 51f8d694104d972ce485ebbf64e8dce38d9758b9..8d8a610f914411043dc2b8daaf88d44fbc31867d 100644 (file)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -261,6 +261,11 @@ struct canfd_quirk {
        u8 quirk;
 } __packed;
 
+/* struct gs_host_frame::echo_id == GS_HOST_FRAME_ECHO_ID_RX indicates
+ * a regular RX'ed CAN frame
+ */
+#define GS_HOST_FRAME_ECHO_ID_RX 0xffffffff
+
 struct gs_host_frame {
        struct_group(header,
                u32 echo_id;
@@ -570,6 +575,37 @@ gs_usb_get_echo_skb(struct gs_can *dev, struct sk_buff *skb,
        return len;
 }
 
+static unsigned int
+gs_usb_get_minimum_rx_length(const struct gs_can *dev, const struct gs_host_frame *hf,
+                            unsigned int *data_length_p)
+{
+       unsigned int minimum_length, data_length = 0;
+
+       if (hf->flags & GS_CAN_FLAG_FD) {
+               if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX)
+                       data_length = can_fd_dlc2len(hf->can_dlc);
+
+               if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
+                       /* timestamp follows data field of max size */
+                       minimum_length = struct_size(hf, canfd_ts, 1);
+               else
+                       minimum_length = sizeof(hf->header) + data_length;
+       } else {
+               if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX &&
+                   !(hf->can_id & cpu_to_le32(CAN_RTR_FLAG)))
+                       data_length = can_cc_dlc2len(hf->can_dlc);
+
+               if (dev->feature & GS_CAN_FEATURE_HW_TIMESTAMP)
+                       /* timestamp follows data field of max size */
+                       minimum_length = struct_size(hf, classic_can_ts, 1);
+               else
+                       minimum_length = sizeof(hf->header) + data_length;
+       }
+
+       *data_length_p = data_length;
+       return minimum_length;
+}
+
 static void gs_usb_receive_bulk_callback(struct urb *urb)
 {
        struct gs_usb *parent = urb->context;
@@ -578,7 +614,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
        int rc;
        struct net_device_stats *stats;
        struct gs_host_frame *hf = urb->transfer_buffer;
-       unsigned int minimum_length;
+       unsigned int minimum_length, data_length;
        struct gs_tx_context *txc;
        struct can_frame *cf;
        struct canfd_frame *cfd;
@@ -621,20 +657,33 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
        if (!netif_running(netdev))
                goto resubmit_urb;
 
-       if (hf->echo_id == -1) { /* normal rx */
+       minimum_length = gs_usb_get_minimum_rx_length(dev, hf, &data_length);
+       if (urb->actual_length < minimum_length) {
+               stats->rx_errors++;
+               stats->rx_length_errors++;
+
+               if (net_ratelimit())
+                       netdev_err(netdev,
+                                  "short read (actual_length=%u, minimum_length=%u)\n",
+                                  urb->actual_length, minimum_length);
+
+               goto resubmit_urb;
+       }
+
+       if (hf->echo_id == GS_HOST_FRAME_ECHO_ID_RX) { /* normal rx */
                if (hf->flags & GS_CAN_FLAG_FD) {
                        skb = alloc_canfd_skb(netdev, &cfd);
                        if (!skb)
                                return;
 
                        cfd->can_id = le32_to_cpu(hf->can_id);
-                       cfd->len = can_fd_dlc2len(hf->can_dlc);
+                       cfd->len = data_length;
                        if (hf->flags & GS_CAN_FLAG_BRS)
                                cfd->flags |= CANFD_BRS;
                        if (hf->flags & GS_CAN_FLAG_ESI)
                                cfd->flags |= CANFD_ESI;
 
-                       memcpy(cfd->data, hf->canfd->data, cfd->len);
+                       memcpy(cfd->data, hf->canfd->data, data_length);
                } else {
                        skb = alloc_can_skb(netdev, &cf);
                        if (!skb)
@@ -643,7 +692,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
                        cf->can_id = le32_to_cpu(hf->can_id);
                        can_frame_set_cc_len(cf, hf->can_dlc, dev->can.ctrlmode);
 
-                       memcpy(cf->data, hf->classic_can->data, 8);
+                       memcpy(cf->data, hf->classic_can->data, data_length);
 
                        /* ERROR frames tell us information about the controller */
                        if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)