can: j1939: transport: j1939_xtp_rx_eoma_one(): Add sanity check for correct total...
authorOleksij Rempel <o.rempel@pengutronix.de>
Fri, 25 Oct 2019 13:04:13 +0000 (15:04 +0200)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Mon, 4 Nov 2019 20:47:23 +0000 (21:47 +0100)
We were sending malformed EOMA with total message size set to 0. This
issue has been fixed in the previous patch.

In this patch a sanity check is added to the RX path and a error message
is displayed.

Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
net/can/j1939/transport.c

index 06183d6..e5f1a56 100644 (file)
@@ -1273,9 +1273,27 @@ j1939_xtp_rx_abort(struct j1939_priv *priv, struct sk_buff *skb,
 static void
 j1939_xtp_rx_eoma_one(struct j1939_session *session, struct sk_buff *skb)
 {
+       struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+       const u8 *dat;
+       int len;
+
        if (j1939_xtp_rx_cmd_bad_pgn(session, skb))
                return;
 
+       dat = skb->data;
+
+       if (skcb->addr.type == J1939_ETP)
+               len = j1939_etp_ctl_to_size(dat);
+       else
+               len = j1939_tp_ctl_to_size(dat);
+
+       if (session->total_message_size != len) {
+               netdev_warn_once(session->priv->ndev,
+                                "%s: 0x%p: Incorrect size. Expected: %i; got: %i.\n",
+                                __func__, session, session->total_message_size,
+                                len);
+       }
+
        netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session);
 
        session->pkt.tx_acked = session->pkt.total;