pull-request: can 2016-12-07

pull-request: can 2016-12-07

[Marc Kleine-Budde]

Hello David,

Andrey Konovalov triggered a warning in the CAN RAW layer, which is fixed by a
patch by me.

regards,
Marc

---

The following changes since commit bc3913a5378cd0ddefd1dfec6917cc12eb23a946:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc (2016-12-06 09:24:11 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-4.9-20161207

for you to fetch changes up to 332b05ca7a438f857c61a3c21a88489a21532364:

  can: raw: raw_setsockopt: limit number of can_filter that can be set (2016-12-07 10:45:57 +0100)

----------------------------------------------------------------
linux-can-fixes-for-4.9-20161207

----------------------------------------------------------------
Marc Kleine-Budde (1):
      can: raw: raw_setsockopt: limit number of can_filter that can be set

 include/uapi/linux/can.h | 1 +
 net/can/raw.c            | 3 +++
 2 files changed, 4 insertions(+)

[PATCH] can: raw: raw_setsockopt: limit number of can_filter that can be set

[Marc Kleine-Budde]

This patch adds a check to limit the number of can_filters that can be
set via setsockopt on CAN_RAW sockets. Otherwise allocations > MAX_ORDER
are not prevented resulting in a warning.

Reference: https://lkml.org/lkml/2016/12/2/230

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 include/uapi/linux/can.h | 1 +
 net/can/raw.c            | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
index 9692cda5f8fc..c48d93a28d1a 100644
--- a/include/uapi/linux/can.h
+++ b/include/uapi/linux/can.h
@@ -196,5 +196,6 @@ struct can_filter {
 };
 
 #define CAN_INV_FILTER 0x20000000U /* to be set in can_filter.can_id */
+#define CAN_RAW_FILTER_MAX 512 /* maximum number of can_filter set via setsockopt() */
 
 #endif /* !_UAPI_CAN_H */
diff --git a/net/can/raw.c b/net/can/raw.c
index 972c187d40ab..b075f028d7e2 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -499,6 +499,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 		if (optlen % sizeof(struct can_filter) != 0)
 			return -EINVAL;
 
+		if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter))
+			return -EINVAL;
+
 		count = optlen / sizeof(struct can_filter);
 
 		if (count > 1) {
-- 
2.10.2

Re: pull-request: can 2016-12-07

[David Miller]

From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Wed,  7 Dec 2016 10:50:39 +0100

> Andrey Konovalov triggered a warning in the CAN RAW layer, which is
> fixed by a patch by me.

Pulled, thanks Marc.