summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOliver Hartkopp <socketcan@hartkopp.net>2015-01-05 18:40:15 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2015-01-29 17:40:42 -0800
commit96bfa3859e9c40f53ecc79ea3c23dbb72188a56b (patch)
tree673b61501b7413373e9f6421f72331a684756091
parent71745ce1b85ccb00d6374bcdc310ee134da85d1f (diff)
can: dev: fix crtlmode_supported check
commit 9b1087aa5e86448fe6ad40a58964e35f3ba423d5 upstream. When changing flags in the CAN drivers ctrlmode the provided new content has to be checked whether the bits are allowed to be changed. The bits that are to be changed are given as a bitfield in cm->mask. Therefore checking against cm->flags is wrong as the content can hold any kind of values. The iproute2 tool sets the bits in cm->mask and cm->flags depending on the detected command line options. To be robust against bogus user space applications additionally sanitize the provided flags with the provided mask. Cc: Wolfgang Grandegger <wg@grandegger.com> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/net/can/dev.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 2cfe5012e4e5..4b008c9c738d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -729,10 +729,14 @@ static int can_changelink(struct net_device *dev,
if (dev->flags & IFF_UP)
return -EBUSY;
cm = nla_data(data[IFLA_CAN_CTRLMODE]);
- if (cm->flags & ~priv->ctrlmode_supported)
+
+ /* check whether changed bits are allowed to be modified */
+ if (cm->mask & ~priv->ctrlmode_supported)
return -EOPNOTSUPP;
+
+ /* clear bits to be modified and copy the flag values */
priv->ctrlmode &= ~cm->mask;
- priv->ctrlmode |= cm->flags;
+ priv->ctrlmode |= (cm->flags & cm->mask);
/* CAN_CTRLMODE_FD can only be set when driver supports FD */
if (priv->ctrlmode & CAN_CTRLMODE_FD)