From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FDCCC433E1 for ; Mon, 24 Aug 2020 17:23:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 406BB20738 for ; Mon, 24 Aug 2020 17:23:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1598289827; bh=Y+dzBIhGF+kbEmw58dJ4IZaOWYovq8f4Yu+nhkSCnkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OL5/Dv+ZncMiW2iMdNV6+BCoPJpaBDYSD9B7Wtjm53PLybLYGkcaurqZFANW6Kggr 0jlneSlspmcnF6xlmENJP//lA1Dw/PYlxafZ+VFcxxSXw9UHXdciP2NVJyzWHoex5J Dt+K3dw6I2sgzFZ+TCX5h4xHkxtUG9EnZ6LTXHFU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728290AbgHXRXm (ORCPT ); Mon, 24 Aug 2020 13:23:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:40124 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728273AbgHXQfo (ORCPT ); Mon, 24 Aug 2020 12:35:44 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4ED6B22CF7; Mon, 24 Aug 2020 16:35:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1598286944; bh=Y+dzBIhGF+kbEmw58dJ4IZaOWYovq8f4Yu+nhkSCnkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jek+oqzy3XtLnluiCYHhJbsfBHcpqpC0WGOyvPWreqZpC/R6RDylwL9ypCXcdoNXB 8QaF9NtXpLB0qOTIRuina3nE1Xns9REgrkk7sSZP3GX+sxTEvaBK7BnJMcV7Y2LGVo PMgPrBBl3o+eQlHSfsvpRcM/2Agc1/dFNSVJVsfk= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Oleksij Rempel , Marc Kleine-Budde , Sasha Levin , linux-can@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.8 29/63] can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to detect corruptions Date: Mon, 24 Aug 2020 12:34:29 -0400 Message-Id: <20200824163504.605538-29-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200824163504.605538-1-sashal@kernel.org> References: <20200824163504.605538-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Oleksij Rempel [ Upstream commit e052d0540298bfe0f6cbbecdc7e2ea9b859575b2 ] Since the stack relays on receiving own packets, it was overwriting own transmit buffer from received packets. At least theoretically, the received echo buffer can be corrupt or changed and the session partner can request to resend previous data. In this case we will re-send bad data. With this patch we will stop to overwrite own TX buffer and use it for sanity checking. Signed-off-by: Oleksij Rempel Link: https://lore.kernel.org/r/20200807105200.26441-6-o.rempel@pengutronix.de Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- net/can/j1939/transport.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 9f99af5b0b11e..3e9c377b0dcce 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1769,7 +1769,20 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, } tpdat = se_skb->data; - memcpy(&tpdat[offset], &dat[1], nbytes); + if (!session->transmission) { + memcpy(&tpdat[offset], &dat[1], nbytes); + } else { + int err; + + err = memcmp(&tpdat[offset], &dat[1], nbytes); + if (err) + netdev_err_once(priv->ndev, + "%s: 0x%p: Data of RX-looped back packet (%*ph) doesn't match TX data (%*ph)!\n", + __func__, session, + nbytes, &dat[1], + nbytes, &tpdat[offset]); + } + if (packet == session->pkt.rx) session->pkt.rx++; -- 2.25.1