can: add sanity checks

[pandora-kernel.git] / net / can / af_can.c

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 7e8ca28..484bbf6 100644 (file)
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -205,12 +205,19 @@ static int can_create(struct net *net, struct socket *sock, int protocol)
  *  -ENOBUFS on full driver queue (see net_xmit_errno())
  *  -ENOMEM when local loopback failed at calling skb_clone()
  *  -EPERM when trying to send on a non-CAN interface
  *  -ENOBUFS on full driver queue (see net_xmit_errno())
  *  -ENOMEM when local loopback failed at calling skb_clone()
  *  -EPERM when trying to send on a non-CAN interface

+ *  -EINVAL when the skb->data does not contain a valid CAN frame

  */
 int can_send(struct sk_buff *skb, int loop)
 {
        struct sk_buff *newskb = NULL;
  */
 int can_send(struct sk_buff *skb, int loop)
 {
        struct sk_buff *newskb = NULL;

+       struct can_frame *cf = (struct can_frame *)skb->data;

        int err;
 
        int err;
 

+       if (skb->len != sizeof(struct can_frame) || cf->can_dlc > 8) {
+               kfree_skb(skb);
+               return -EINVAL;
+       }
+

        if (skb->dev->type != ARPHRD_CAN) {
                kfree_skb(skb);
                return -EPERM;
        if (skb->dev->type != ARPHRD_CAN) {
                kfree_skb(skb);
                return -EPERM;


@@ -605,6 +612,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                   struct packet_type *pt, struct net_device *orig_dev)
 {
        struct dev_rcv_lists *d;
                   struct packet_type *pt, struct net_device *orig_dev)
 {
        struct dev_rcv_lists *d;

+       struct can_frame *cf = (struct can_frame *)skb->data;

        int matches;
 
        if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) {
        int matches;
 
        if (dev->type != ARPHRD_CAN || dev_net(dev) != &init_net) {


@@ -612,6 +620,8 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
                return 0;
        }
 
                return 0;
        }
 

+       BUG_ON(skb->len != sizeof(struct can_frame) || cf->can_dlc > 8);
+

        /* update statistics */
        can_stats.rx_frames++;
        can_stats.rx_frames_delta++;
        /* update statistics */
        can_stats.rx_frames++;
        can_stats.rx_frames_delta++;