From: Oleksij Rempel o.rempel@pengutronix.de
mainline inclusion from mainline-v5.9-rc2 commit b43e3a82bc432c1caaed8950e7662c143470c54c category: bugfix bugzilla: 38684 CVE: NA
---------------------------
In current J1939 stack implementation, we process all locally send messages as own messages. Even if it was send by CAN_RAW socket.
To reproduce it use following commands: testj1939 -P -r can0:0x80 & cansend can0 18238040#0123
This step will trigger false positive not critical warning: j1939_simple_recv: Received already invalidated message
With this patch we add additional check to make sure, related skb is own echo message.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Oleksij Rempel o.rempel@pengutronix.de Link: https://lore.kernel.org/r/20200807105200.26441-2-o.rempel@pengutronix.de Signed-off-by: Marc Kleine-Budde mkl@pengutronix.de Signed-off-by: Zhang Changzhong zhangchangzhong@huawei.com Reviewed-by: Yue Haibing yuehaibing@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- net/can/j1939/socket.c | 1 + net/can/j1939/transport.c | 4 ++++ 2 files changed, 5 insertions(+)
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index 2f4e2142ef268..7f003bb365bfd 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -398,6 +398,7 @@ static int j1939_sk_init(struct sock *sk) spin_lock_init(&jsk->sk_session_queue_lock); INIT_LIST_HEAD(&jsk->sk_session_queue); sk->sk_destruct = j1939_sk_sock_destruct; + sk->sk_protocol = CAN_J1939;
return 0; } diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index fad210ee4c785..0ead38b2fa485 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -2041,6 +2041,10 @@ void j1939_simple_recv(struct j1939_priv *priv, struct sk_buff *skb) if (!skb->sk) return;
+ if (skb->sk->sk_family != AF_CAN || + skb->sk->sk_protocol != CAN_J1939) + return; + j1939_session_list_lock(priv); session = j1939_session_get_simple(priv, skb); j1939_session_list_unlock(priv);