* pull-request: can 2013-08-09
@ 2013-08-09 9:44 Marc Kleine-Budde
2013-08-09 9:44 ` [PATCH] can: pcan_usb: fix wrong memcpy() bytes length Marc Kleine-Budde
0 siblings, 1 reply; 3+ messages in thread
From: Marc Kleine-Budde @ 2013-08-09 9:44 UTC (permalink / raw)
To: netdev; +Cc: kernel, linux-can, davem
here is a fix for the v3.11 release cycle:
Stephane Grosjean has found and fixed a potential wrong length for the mempy()
in pcan_usb's decode usb data function.
regards,
Marc
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] can: pcan_usb: fix wrong memcpy() bytes length
2013-08-09 9:44 pull-request: can 2013-08-09 Marc Kleine-Budde
@ 2013-08-09 9:44 ` Marc Kleine-Budde
2013-08-12 4:52 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Marc Kleine-Budde @ 2013-08-09 9:44 UTC (permalink / raw)
To: netdev
Cc: kernel, linux-can, davem, Stephane Grosjean, linux-stable,
Marc Kleine-Budde
From: Stephane Grosjean <s.grosjean@peak-system.com>
Fix possibly wrong memcpy() bytes length since some CAN records received from
PCAN-USB could define a DLC field in range [9..15].
In that case, the real DLC value MUST be used to move forward the record pointer
but, only 8 bytes max. MUST be copied into the data field of the struct
can_frame object of the skb given to the network core.
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/usb/peak_usb/pcan_usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 25723d8..925ab8e 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -649,7 +649,7 @@ static int pcan_usb_decode_data(struct pcan_usb_msg_context *mc, u8 status_len)
if ((mc->ptr + rec_len) > mc->end)
goto decode_failed;
- memcpy(cf->data, mc->ptr, rec_len);
+ memcpy(cf->data, mc->ptr, cf->can_dlc);
mc->ptr += rec_len;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] can: pcan_usb: fix wrong memcpy() bytes length
2013-08-09 9:44 ` [PATCH] can: pcan_usb: fix wrong memcpy() bytes length Marc Kleine-Budde
@ 2013-08-12 4:52 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2013-08-12 4:52 UTC (permalink / raw)
To: mkl; +Cc: netdev, kernel, linux-can, s.grosjean, stable
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Fri, 9 Aug 2013 11:44:06 +0200
> From: Stephane Grosjean <s.grosjean@peak-system.com>
>
> Fix possibly wrong memcpy() bytes length since some CAN records received from
> PCAN-USB could define a DLC field in range [9..15].
> In that case, the real DLC value MUST be used to move forward the record pointer
> but, only 8 bytes max. MUST be copied into the data field of the struct
> can_frame object of the skb given to the network core.
>
> Cc: linux-stable <stable@vger.kernel.org>
> Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-08-12 4:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-08-09 9:44 pull-request: can 2013-08-09 Marc Kleine-Budde
2013-08-09 9:44 ` [PATCH] can: pcan_usb: fix wrong memcpy() bytes length Marc Kleine-Budde
2013-08-12 4:52 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).