[PATCH net 0/2] can: bittiming: fix two defects in the userspace bitrate conversion

[Sureshkumar S]

can_calc_bittiming() converts a userspace supplied bitrate into hardware
timing parameters. Two defects in that conversion are fixed here, both
reachable through IFLA_CAN_BITTIMING on any CAN device that provides a
bittiming_const, and both caused by 32 bit arithmetic on a value that
userspace fully controls.

Patch 1 fixes a divide-by-zero. The 32 bit tsegall * bt->bitrate product
wraps to zero for bitrates carrying enough factors of two, and the
following division faults. A bitrate of 16777216 is already enough,
which is below the 20 Mbit/s CAN XL data bitrate ceiling.

Patch 2 fixes the candidate rating, which applies abs() to an unsigned
subtraction. A wrapped difference is read back as a small error, so a
bitrate far outside what the controller can reach passes the 5% gate and
is silently accepted instead of rejected.

Both were found with a netlink fuzzer against dummy_can and verified
under KASAN in QEMU. Testing covered the unpatched tree, patch 1 alone
and the full series: bitrates from 125 kbit/s to 10 Mbit/s produce
byte-identical bittiming at every step, patch 1 alone removes the oops,
and patch 2 turns the silently accepted out-of-range bitrates into
-EINVAL.

Sureshkumar S (2):
  can: bittiming: fix divide-by-zero in can_calc_bittiming()
  can: bittiming: fix bitrate error calculation on unsigned operands

 drivers/net/can/dev/calc_bittiming.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)


base-commit: af39eb111ce6b5eba9c08513b62c4868eb7e7fd5
-- 
2.43.0