diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-07 09:24:28 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-07 09:24:28 -0700 |
| commit | b2798bf0ec2cb5a17bfc1430c5ba6d971c436a03 (patch) | |
| tree | ef2b01160811d8d6312518a177968d58d5fe9e44 /net/can/af_can.c | |
| parent | 3bc5ab9b7f2760d2892fd0a0589e1077e869d4f5 (diff) | |
| parent | 7f2d38eb7a42bea1c1df51bbdaa2ca0f0bdda07f (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
can: add sanity checks
fs_enet: restore promiscuous and multicast settings in restart()
ibm_newemac: Fixes entry of short packets
ibm_newemac: Fixes kernel crashes when speed of cable connected changes
pasemi_mac: Access iph->tot_len with correct endianness
ehea: Access iph->tot_len with correct endianness
ehea: fix race condition
ehea: add MODULE_DEVICE_TABLE
ehea: fix might sleep problem
forcedeth: fix lockdep warning on ethtool -s
Add missing skb->dev assignment in Frame Relay RX code
bridge: fix use-after-free in br_cleanup_bridges()
tcp: fix a size_t < 0 comparison in tcp_read_sock
tcp: net/ipv4/tcp.c needs linux/scatterlist.h
libertas: support USB persistence on suspend/resume (resend)
iwlwifi: drop skb silently for Tx request in monitor mode
iwlwifi: fix incorrect 5GHz rates reported in monitor mode
Diffstat (limited to 'net/can/af_can.c')
| -rw-r--r-- | net/can/af_can.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/net/can/af_can.c b/net/can/af_can.c index 7e8ca283645..484bbf6dd03 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol) * -ENOBUFS on full driver queue (see net_xmit_errno()) * -ENOMEM when local loopback failed at calling skb_clone() * -EPERM when trying to send on a non-CAN interface + * -EINVAL when the skb->data does not contain a valid CAN frame */ int can_send(struct sk_buff *skb, int loop) { struct sk_buff *newskb = NULL; + struct can_frame *cf = (struct can_frame *)skb->data; int err; + if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) { + kfree_skb(skb); + return -EINVAL; + } + if (skb->dev->type != ARPHRD_CAN) { kfree_skb(skb); return -EPERM; @@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev) { struct dev_rcv_lists *d; + struct can_frame *cf = (struct can_frame *)skb->data; int matches; if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) { @@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, return 0; } + BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8); + /* update statistics */ can_stats.rx_frames++; can_stats.rx_frames_delta++; |