Commit 688d11c3 authored by Oleksij Rempel's avatar Oleksij Rempel Committed by Marc Kleine-Budde

can: j1939: transport: j1939_xtp_rx_eoma_one(): Add sanity check for correct total message size

We were sending malformed EOMA with total message size set to 0. This
issue has been fixed in the previous patch.

In this patch a sanity check is added to the RX path and a error message
is displayed.
Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent eaa654f1
......@@ -1273,9 +1273,27 @@ j1939_xtp_rx_abort(struct j1939_priv *priv, struct sk_buff *skb,
static void
j1939_xtp_rx_eoma_one(struct j1939_session *session, struct sk_buff *skb)
{
struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
const u8 *dat;
int len;
if (j1939_xtp_rx_cmd_bad_pgn(session, skb))
return;
dat = skb->data;
if (skcb->addr.type == J1939_ETP)
len = j1939_etp_ctl_to_size(dat);
else
len = j1939_tp_ctl_to_size(dat);
if (session->total_message_size != len) {
netdev_warn_once(session->priv->ndev,
"%s: 0x%p: Incorrect size. Expected: %i; got: %i.\n",
__func__, session, session->total_message_size,
len);
}
netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session);
session->pkt.tx_acked = session->pkt.total;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment