Marc Kleine-Budde 1079b56de4 can: isotp: convert struct tpcon::{idx,len} to unsigned int ... commit 5f33a09e76 upstream. In isotp_rcv_ff() 32 bit of data received over the network is assigned to struct tpcon::len. Later in that function the length is checked for the maximal supported length against MAX_MSG_LENGTH. As struct tpcon::len is an "int" this check does not work, if the provided length overflows the "int". Later on struct tpcon::idx is compared against struct tpcon::len. To fix this problem this patch converts both struct tpcon::{idx,len} to unsigned int. Fixes: e057dd3fc2 ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/20220105132429.1170627-1-mkl@pengutronix.de Cc: stable@vger.kernel.org Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Reported-by: syzbot+4c63f36709a642f801c5@syzkaller.appspotmail.com Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-01-16 09:12:44 +01:00
..
j1939	can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM	2021-11-18 19:16:03 +01:00
Kconfig	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
Makefile	can: add ISO 15765-2:2016 transport protocol	2020-10-07 23:18:33 +02:00
af_can.c	net: introduce CAN specific pointer in the struct net_device	2021-02-24 14:32:15 -08:00
af_can.h	can: introduce CAN midlayer private and allocate it automatically	2019-09-04 13:29:14 +02:00
bcm.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-06-29 15:45:27 -07:00
gw.c	can: gw: synchronize rcu operations before removing gw job entry	2021-06-19 23:53:43 +02:00
isotp.c	can: isotp: convert struct tpcon::{idx,len} to unsigned int	2022-01-16 09:12:44 +01:00
proc.c	can: proc: remove unnecessary variables	2021-05-27 09:42:21 +02:00
raw.c	net: Remove redundant if statements	2021-08-05 13:27:50 +01:00