Commit 502a2ce9 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'linux-can-fixes-for-5.16-20220105' of... 

Merge tag 'linux-can-fixes-for-5.16-20220105' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2022-01-05

It consists of 2 patches, both by me. The first one fixes the use of
an uninitialized variable in the gs_usb driver the other one a
skb_over_panic in the ISOTP stack in case of reception of too large
ISOTP messages.

* tag 'linux-can-fixes-for-5.16-20220105' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
  can: isotp: convert struct tpcon::{idx,len} to unsigned int
  can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data
====================

Link: https://lore.kernel.org/r/20220105205443.1274709-1-mkl@pengutronix.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 75acfdb6 5f33a09e

drivers/net/can/usb/gs_usb.c

+2 −1
Original line number Diff line number Diff line
@@ -321,7 +321,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) 


	/* device reports out of range channel id */

	if (hf->channel >= GS_MAX_INTF)

		goto resubmit_urb;

		goto device_detach;



	dev = usbcan->canch[hf->channel];
@@ -406,6 +406,7 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) 


	/* USB failure take down all interfaces */

	if (rc == -ENODEV) {

 device_detach:

		for (rc = 0; rc < GS_MAX_INTF; rc++) {

			if (usbcan->canch[rc])

				netif_device_detach(usbcan->canch[rc]->netdev);

net/can/isotp.c

+2 −2
Original line number Diff line number Diff line
@@ -119,8 +119,8 @@ enum { 
};



struct tpcon {

	int idx;

	int len;

	unsigned int idx;

	unsigned int len;

	u32 state;

	u8 bs;

	u8 sn;