kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Vincent Mailhol b26cccd87d can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow 
[ Upstream commit 38c0abad45 ]

Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.

Unfortunately, because the etas_es58x driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:

  $ ip link set can0 mtu 9999

After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:

	socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));

to inject a malicious CAN XL frames. For example:

	struct canxl_frame frame = {
		.flags = 0xff,
		.len = 2048,
	};

The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:

  1. the skb->protocol is set to ETH_P_CANXL which is valid (the
     function does not check the actual device capabilities).

  2. the length is a valid CAN XL length.

And so, es58x_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN(FD)
frame.

This can result in a buffer overflow. For example, using the es581.4
variant, the frame will be dispatched to es581_4_tx_can_msg(), go
through the last check at the beginning of this function:

	if (can_is_canfd_skb(skb))
		return -EMSGSIZE;

and reach this line:

	memcpy(tx_can_msg->data, cf->data, cf->len);

Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs!

Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU or
CANFD_MTU (depending on the device capabilities). By fixing the root
cause, this prevents the buffer overflow.

Fixes: 8537257874 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-1-0d1cada9393b@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-10-02 13:44:09 +02:00
..
accel accel/ivpu: Prevent recovery work from being queued during device removal 2025-09-09 18:58:14 +02:00
accessibility treewide: remove unnecessary <linux/version.h> inclusion 2024-08-12 18:36:44 +09:00
acpi ACPI: RISC-V: Fix FFH_CPPC_CSR error handling 2025-09-09 18:58:26 +02:00
amba ARM: 9416/1: amba: make amba_bustype constant 2024-09-04 15:01:17 +01:00
android binder: fix offset calculation in debug log 2025-05-09 09:50:29 +02:00
ata ata: libata-scsi: Return aborted command when missing sense and result TF 2025-08-28 16:31:04 +02:00
atm atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). 2025-09-04 15:31:47 +02:00
auxdisplay auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" 2025-05-29 11:02:24 +02:00
base x86/vmscape: Enable the mitigation 2025-09-11 17:21:46 +02:00
bcma PCI: Rename CRS Completion Status to RRS 2024-09-10 19:52:30 -05:00
block block: add a queue_limits_commit_update_frozen helper 2025-09-09 18:58:24 +02:00
bluetooth Bluetooth: vhci: Prevent use-after-free by removing debugfs files early 2025-09-09 18:58:07 +02:00
bus bus: mhi: host: Detect events pointing to unexpected TREs 2025-08-28 16:30:54 +02:00
cache cache: StarFive: Require a 64-bit system 2024-08-01 07:15:02 -07:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-10-17 19:47:15 -06:00
cdx cdx: Fix off-by-one error in cdx_rpmsg_probe() 2025-08-28 16:31:09 +02:00
char ipmi: Fix strcpy source and destination the same 2025-08-20 18:30:48 +02:00
clk clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src 2025-08-20 18:30:51 +02:00
clocksource clocksource: mips-gic-timer: Enable counter when CPUs start 2025-05-29 11:02:41 +02:00
comedi comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() 2025-08-28 16:31:09 +02:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-13 11:15:44 +01:00
counter counter: interrupt-cnt: Protect enable/disable OPs with mutex 2025-06-19 15:32:12 +02:00
cpufreq cpufreq: Initialize cpufreq-based invariance before subsys 2025-10-02 13:44:08 +02:00
cpuidle cpuidle: governors: menu: Avoid selecting states with too much latency 2025-08-28 16:31:08 +02:00
crypto crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 2025-08-28 16:30:55 +02:00
cxl cxl/region: Add a dev_err() on missing target list entries 2025-07-06 11:01:32 +02:00
dax dax: delete a stale directory pmem 2024-12-05 14:02:13 +01:00
dca Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
devfreq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() 2025-08-20 18:30:23 +02:00
dio dio: Have dio_bus_match() callback take a const * 2024-07-10 15:38:14 +02:00
dma dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate 2025-09-19 16:35:51 +02:00
dma-buf Revert "udmabuf: fix vmap_udmabuf error page set" 2025-09-19 16:35:42 +02:00
dpll dpll: Add an assertion to check freq_supported_num 2025-05-29 11:02:31 +02:00
edac EDAC/altera: Delete an inappropriate dma_free_coherent() call 2025-09-19 16:35:45 +02:00
eisa driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
extcon Char/Misc and other driver changes for 6.12-rc1 2024-09-26 10:13:08 -07:00
firewire firewire: core: fix overlooked update of subsystem ABI version 2025-10-02 13:44:05 +02:00
firmware efi: stmm: Fix incorrect buffer allocation method 2025-09-04 15:31:48 +02:00
fpga fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() 2025-08-28 16:31:08 +02:00
fsi move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
gnss [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
gpio gpio: tps65912: check the return value of regmap_update_bits() 2025-08-20 18:30:24 +02:00
gpu drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() 2025-09-25 11:13:48 +02:00
greybus greybus: gb-beagleplay: Add error handling for gb_greybus_init 2025-04-10 14:39:22 +02:00
hid HID: amd_sfh: Add sync across amd sfh work functions 2025-10-02 13:44:07 +02:00
hsi HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition 2025-04-20 10:16:02 +02:00
hte hte: tegra-194: add missing MODULE_DESCRIPTION() macro 2024-06-19 12:24:03 -07:00
hv Drivers: hv: Make the sysfs node size for the ring buffer dynamic 2025-08-01 09:48:47 +01:00
hwmon hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM 2025-09-09 18:58:24 +02:00
hwspinlock hwspinlock: qcom: implement bust operation 2024-05-29 12:52:26 -07:00
hwtracing coresight: Only check bottom two claim bits 2025-07-06 11:01:34 +02:00
i2c i2c: designware: Add quirk for Intel Xe 2025-10-02 13:44:07 +02:00
i3c i3c: master: Initialize ret in i3c_i2c_notifier_call() 2025-08-20 18:30:46 +02:00
idle intel_idle: Allow loading ACPI tables for any family 2025-08-20 18:30:18 +02:00
iio iio: imu: inv_icm42600: change invalid data error to -EBUSY 2025-08-28 16:31:11 +02:00
infiniband IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions 2025-10-02 13:44:07 +02:00
input Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table 2025-09-19 16:35:48 +02:00
interconnect interconnect: qcom: sc8180x: specify num_nodes 2025-08-15 12:13:38 +02:00
iommu iommu/amd/pgtbl: Fix possible race while increase page table level 2025-09-25 11:13:46 +02:00
ipack driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
irqchip irqchip: Build IMX_MU_MSI only on ARM 2025-08-15 12:14:07 +02:00
isdn mISDN: Fix memory leak in dsp_hwec_enable() 2025-09-09 18:58:08 +02:00
leds leds: leds-lp50xx: Handle reg to get correct multi_index 2025-08-20 18:30:43 +02:00
macintosh move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
mailbox mailbox: Not protect module_put with spin_lock_irqsave 2025-07-06 11:01:32 +02:00
mcb mcb: fix a double free bug in chameleon_parse_gdd() 2025-05-02 07:59:08 +02:00
md dm-stripe: fix a possible integer overflow 2025-09-25 11:13:45 +02:00
media media: venus: venc: Clamp param smaller than 1fps and bigger than 240 2025-08-28 16:31:01 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:39:31 +02:00
memstick memstick: Fix deadlock by moving removing flag earlier 2025-08-28 16:31:05 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-05 14:02:10 +01:00
mfd mfd: cros_ec: Separate charge-control probing from USB-PD 2025-08-20 18:30:56 +02:00
misc misc: rtsx: usb: Ensure mmc child device is active when card is present 2025-08-20 18:30:52 +02:00
mmc mmc: sdhci-cadence: add Mobileye eyeQ support 2025-10-02 13:44:06 +02:00
most most: core: Drop device reference after usage in get_channel() 2025-08-28 16:31:09 +02:00
mtd mtd: spinand: winbond: Fix oob_layout for W25N01JW 2025-09-19 16:35:47 +02:00
mux mux: remove usage of the deprecated ida_simple_xx() API 2024-04-29 08:20:07 -07:00
net can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow 2025-10-02 13:44:09 +02:00
nfc move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
ntb ntb_hw_amd: Add NTB PCI ID for new gen CPU 2025-05-02 07:59:20 +02:00
nubus nubus: Make nubus_bus_type static and constant 2024-01-03 13:33:59 +01:00
nvdimm libnvdimm/labels: Fix divide error in nd_label_data_init() 2025-05-29 11:02:09 +02:00
nvme nvme: fix PI insert on write 2025-09-25 11:13:41 +02:00
nvmem nvmem: layouts: u-boot-env: remove crc32 endianness conversion 2025-07-24 08:56:21 +02:00
of of_numa: fix uninitialized memory nodes causing kernel panic 2025-09-09 18:58:16 +02:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-08 09:57:10 +01:00
parisc parisc: pdc_stable: Constify struct kobj_type 2024-09-09 08:53:17 +02:00
parport serial: 8250_pci: Share WCH IDs with parport_serial driver 2025-02-21 14:01:25 +01:00
pci PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up 2025-09-04 15:31:56 +02:00
pcmcia pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch 2025-09-25 11:13:42 +02:00
peci move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
perf perf/arm: Add missing .suppress_bind_attrs 2025-08-20 18:30:33 +02:00
phy phy: ti-pipe3: fix device leak at unbind 2025-09-19 16:35:51 +02:00
pinctrl pinctrl: STMFX: add missing HAS_IOMEM dependency 2025-09-04 15:31:42 +02:00
platform platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk 2025-09-25 11:13:49 +02:00
pmdomain imx8m-blk-ctrl: set ISI panic write hurry level 2025-08-20 18:30:27 +02:00
pnp driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
power power: supply: bq27xxx: restrict no-battery detection to bq27000 2025-09-25 11:13:45 +02:00
powercap powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() 2025-08-15 12:13:36 +02:00
pps pps: clients: gpio: fix interrupt handling order in remove path 2025-08-20 18:30:25 +02:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: Use ratelimite for freerun error message 2025-08-20 18:30:38 +02:00
pwm pwm: mediatek: Fix duty and period setting 2025-08-28 16:30:58 +02:00
rapidio drivers/rapidio/rio_cm.c: prevent possible heap overwrite 2025-06-27 11:11:36 +01:00
ras RAS/AMD/FMPM: Get masked address 2025-04-25 10:47:56 +02:00
regulator regulator: sy7636a: fix lifecycle of power good gpio 2025-09-19 16:35:50 +02:00
remoteproc remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU 2025-08-20 18:30:22 +02:00
reset reset: brcmstb: Enable reset drivers for ARCH_BCM2835 2025-08-20 18:30:25 +02:00
rpmsg rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() 2025-06-19 15:32:06 +02:00
rtc rtc: pcf2127: fix SPI command byte for PCF2131 backport 2025-09-25 11:13:50 +02:00
s390 s390/sclp: Fix SCCB present check 2025-08-28 16:31:06 +02:00
sbus [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
scsi scsi: sr: Reinstate rotational media flag 2025-09-09 18:58:24 +02:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-05 14:03:10 +01:00
siox Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 13:02:16 +01:00
soc soc: qcom: mdt_loader: Deal with zero e_shentsize 2025-09-09 18:58:17 +02:00
soundwire soundwire: Move handle_nested_irq outside of sdw_dev_lock 2025-08-20 18:30:46 +02:00
spi spi: spi-fsl-lpspi: Clear status register after disabling the module 2025-09-09 18:58:25 +02:00
spmi spmi: pmic-arb: fix return path in for_each_available_child_of_node() 2024-12-09 10:41:03 +01:00
ssb driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
staging media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() 2025-08-28 16:31:00 +02:00
target scsi: target: core: Generate correct identifiers for PR OUT transport IDs 2025-08-20 18:30:48 +02:00
tc driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
tee tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" 2025-09-09 18:58:03 +02:00
thermal thermal/drivers/mediatek/lvts: Disable low offset IRQ for minimum threshold 2025-09-09 18:58:22 +02:00
thunderbolt thunderbolt: Fix copy+paste error in match_service_id() 2025-08-20 18:30:52 +02:00
tty serial: sc16is7xx: fix bug in flow control levels init 2025-09-19 16:35:48 +02:00
ufs scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE 2025-10-02 13:44:05 +02:00
uio uio_hv_generic: Align ring size to system page 2025-06-27 11:11:25 +01:00
usb usb: core: Add 0x prefix to quirks debug output 2025-10-02 13:44:06 +02:00
vdpa vdpa: Fix IDR memory leak in VDUSE module exit 2025-08-15 12:13:58 +02:00
vfio vfio/mlx5: fix possible overflow in tracking max message size 2025-08-20 18:30:48 +02:00
vhost vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() 2025-09-04 15:31:44 +02:00
video Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" 2025-08-28 16:30:55 +02:00
virt fix locking in efi_secret_unlink() 2025-08-20 18:30:21 +02:00
virtio virtio_ring: Fix error reporting in virtqueue_resize 2025-08-01 09:48:39 +01:00
w1 w1: fix NULL pointer dereference in probe 2025-04-10 14:39:22 +02:00
watchdog watchdog: iTCO_wdt: Report error if timeout configuration fails 2025-08-20 18:30:42 +02:00
xen xen/gntdev: remove struct gntdev_copy_batch from stack 2025-08-15 12:13:43 +02:00
zorro Driver core changes for 6.11-rc1 2024-07-25 10:42:22 -07:00
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile leds: Init leds class earlier 2024-09-04 17:24:58 -05:00