Commit 9e971474 authored by Oliver Hartkopp's avatar Oliver Hartkopp Committed by Marc Kleine-Budde
Browse files

can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE 



Since commit f5223e9e ("can: extend sockaddr_can to include j1939
members") the sockaddr_can has been extended in size and a new
CAN_REQUIRED_SIZE macro has been introduced to calculate the protocol
specific needed size.

The ABI for the msg_name and msg_namelen has not been adapted to the
new CAN_REQUIRED_SIZE macro for the other CAN protocols which leads to
a problem when an existing binary reads the (increased) struct
sockaddr_can in msg_name.

Fixes: f5223e9e ("can: extend sockaddr_can to include j1939 members")
Reported-by: default avatarRichard Weinberger <richard@nod.at>
Tested-by: default avatarRichard Weinberger <richard@nod.at>
Acked-by: default avatarKurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Link: https://lore.kernel.org/linux-can/1135648123.112255.1616613706554.JavaMail.zimbra@nod.at/T/#t
Link: https://lore.kernel.org/r/20210325125850.1620-1-socketcan@hartkopp.net


Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 1b479fb8

net/can/bcm.c

+6 −4
Original line number Diff line number Diff line
@@ -86,6 +86,8 @@ MODULE_LICENSE("Dual BSD/GPL"); 
MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");

MODULE_ALIAS("can-proto-2");



#define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)



/*

 * easy access to the first 64 bit of can(fd)_frame payload. cp->data is

 * 64 bit aligned so the offset has to be multiples of 8 which is ensured
@@ -1292,7 +1294,7 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 
		/* no bound device as default => check msg_name */

		DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);



		if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex))

		if (msg->msg_namelen < BCM_MIN_NAMELEN)

			return -EINVAL;



		if (addr->can_family != AF_CAN)
@@ -1534,7 +1536,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, 
	struct net *net = sock_net(sk);

	int ret = 0;



	if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex))

	if (len < BCM_MIN_NAMELEN)

		return -EINVAL;



	lock_sock(sk);
@@ -1616,8 +1618,8 @@ static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 
	sock_recv_ts_and_drops(msg, sk, skb);



	if (msg->msg_name) {

		__sockaddr_check_size(sizeof(struct sockaddr_can));

		msg->msg_namelen = sizeof(struct sockaddr_can);

		__sockaddr_check_size(BCM_MIN_NAMELEN);

		msg->msg_namelen = BCM_MIN_NAMELEN;

		memcpy(msg->msg_name, skb->cb, msg->msg_namelen);

	}

net/can/raw.c

+8 −6
Original line number Diff line number Diff line
@@ -60,6 +60,8 @@ MODULE_LICENSE("Dual BSD/GPL"); 
MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>");

MODULE_ALIAS("can-proto-1");



#define RAW_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)



#define MASK_ALL 0



/* A raw socket has a list of can_filters attached to it, each receiving
@@ -394,7 +396,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len) 
	int err = 0;

	int notify_enetdown = 0;



	if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex))

	if (len < RAW_MIN_NAMELEN)

		return -EINVAL;

	if (addr->can_family != AF_CAN)

		return -EINVAL;
@@ -475,11 +477,11 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr, 
	if (peer)

		return -EOPNOTSUPP;



	memset(addr, 0, sizeof(*addr));

	memset(addr, 0, RAW_MIN_NAMELEN);

	addr->can_family  = AF_CAN;

	addr->can_ifindex = ro->ifindex;



	return sizeof(*addr);

	return RAW_MIN_NAMELEN;

}



static int raw_setsockopt(struct socket *sock, int level, int optname,
@@ -739,7 +741,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 
	if (msg->msg_name) {

		DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);



		if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex))

		if (msg->msg_namelen < RAW_MIN_NAMELEN)

			return -EINVAL;



		if (addr->can_family != AF_CAN)
@@ -832,8 +834,8 @@ static int raw_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 
	sock_recv_ts_and_drops(msg, sk, skb);



	if (msg->msg_name) {

		__sockaddr_check_size(sizeof(struct sockaddr_can));

		msg->msg_namelen = sizeof(struct sockaddr_can);

		__sockaddr_check_size(RAW_MIN_NAMELEN);

		msg->msg_namelen = RAW_MIN_NAMELEN;

		memcpy(msg->msg_name, skb->cb, msg->msg_namelen);

	}