[PATCH 1/2] can: j1939: reject TP RTS with wrong packet count

[Liu Chao]

j1939_xtp_rx_rts_session_new() computes the expected packet count as
(len + 6) / 7, then unconditionally overwrites it with dat[3] from
the incoming RTS, even when the two disagree.  When dat[3] is smaller,
the session completes after fewer packets than the buffer was sized
for, delivering a short (zero-padded) message to userspace.  When
dat[3] is zero, every incoming data packet looks out of range and the
session hangs until the rx timeout fires.

Abort the session when dat[3] doesn't match or is zero, similar to
how a4fbe70c5cb7 ("can: j1939: j1939_xtp_rx_rts_session_new(): abort
TP less than 9 bytes") rejects out-of-range message sizes.

An alternative would be to silently keep the computed value and ignore
dat[3], but that doesn't actually work: the sender only transmits
dat[3] packets, so the receiver would never collect enough to complete
and would hang until the rx timeout fires -- a worse failure mode than
a clean abort with a clear log message.

  # RTS: len=100 (dat[1..2]=0x0064) but dat[3]=1 (should be 15)
  cansend vcan0 18EC8090#1064000103002301

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Cc: stable@xxxxxxxxxx
Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
---
 net/can/j1939/transport.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 8fcfd13e5..8fdce5792 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1672,11 +1672,16 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv,
 	session->pkt.total = (len + 6) / 7;
 	session->pkt.block = 0xff;
 	if (skcb.addr.type != J1939_ETP) {
-		if (dat[3] != session->pkt.total)
-			netdev_alert(priv->ndev, "%s: 0x%p: strange total, %u != %u\n",
-				     __func__, session, session->pkt.total,
-				     dat[3]);
-		session->pkt.total = dat[3];
+		if (dat[3] != session->pkt.total || dat[3] == 0) {
+			netdev_warn(priv->ndev,
+				    "%s: 0x%p: packet count mismatch, calc %u != RTS %u, abort\n",
+				    __func__, session,
+				    session->pkt.total, dat[3]);
+			j1939_xtp_tx_abort(priv, &skcb, true,
+					   J1939_XTP_ABORT_FAULT, pgn);
+			j1939_session_put(session);
+			return NULL;
+		}
 		session->pkt.block = min(dat[3], dat[4]);
 	}
 
-- 
2.50.1