Skip to contentSkip to conversation

can: ucan: Fix infinite loop from zero-length messages

PATCH Applied Greg Kroah-Hartman 2 participants 2 messages Feb 23 – Mar 2 CAN network drivers

lore
Share & tools
lore

Greg Kroah-Hartman

author
#0 lore raw

PATCH 1/1 can: ucan: Fix infinite loop from zero-length messages

If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one.

This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere.

Cc Marc Kleine-Budde <[email protected]>
Cc Vincent Mailhol <[email protected]>
Cc stable <[email protected]>
Assisted-by gkh_clanker_2000
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/can/usb/ucan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/ucan.c +1 -1
index c79508b1c43e..0ea0ac75e42f 100644
@@ -748,7 +748,7 @@ static void ucan_read_bulk_callback(struct urb *urb)
 		len = le16_to_cpu(m->len);
 
 		/* check sanity (length of content) */
-		if (urb->actual_length - pos < len) {
+		if ((len == 0) || (urb->actual_length - pos < len)) {
 			netdev_warn(up->netdev,
 				    "invalid message (short; no data; l:%d)\n",
 				    urb->actual_length);
Signature · 1 line
2.53.0
maintainer Applied
#1 lore raw
Quoted 10 lines · Greg Kroah-Hartman

If a broken ucan device gets a message with the message length field set to 0, then the driver will loop for forever in ucan_read_bulk_callback(), hanging the system. If the length is 0, just skip the message and go on to the next one.

This has been fixed in the kvaser_usb driver in the past in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"), so there must be some broken devices out there like this somewhere.

Quoted 5 lines
Cc Marc Kleine-Budde <[email protected]>
Cc Vincent Mailhol <[email protected]>
Cc stable <[email protected]>
Assisted-by gkh_clanker_2000
Signed-off-by Greg Kroah-Hartman <[email protected]>

Applied to linux-can, with preferred stable format.

regards,
Marc

Signature · 4 lines
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |