OSDN Git Service

can: peak_usb: add range checking in decode operations
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 13 Aug 2020 14:06:04 +0000 (17:06 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 18 Nov 2020 18:18:43 +0000 (19:18 +0100)
commit8b3913fab07286cce3bd6e88233b204502950df9
treec4f03e4e1627b58fcb9ade18357304c261dbd281
parentef02687fc78099ef3fd2eb8a150c2823fe2d9061
can: peak_usb: add range checking in decode operations

[ Upstream commit a6921dd524fe31d1f460c161d3526a407533b6db ]

These values come from skb->data so Smatch considers them untrusted.  I
believe Smatch is correct but I don't have a way to test this.

The usb_if->dev[] array has 2 elements but the index is in the 0-15
range without checks.  The cfd->len can be up to 255 but the maximum
valid size is CANFD_MAX_DLEN (64) so that could lead to memory
corruption.

Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200813140604.GA456946@mwanda
Acked-by: Stephane Grosjean <s.grosjean@peak-system.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/can/usb/peak_usb/pcan_usb_fd.c