Re: [PATCH net] can: isotp: check the frame type, not just the length

[Quchaosheng]

Re-checked this against a 7.3-rc7 tree before it went in; recording what was
measured.

The field offsets in the message are right:

  sizeof(struct can_frame)    16    CAN_MTU
  sizeof(struct canfd_frame)  72    CANFD_MTU
  canxl_frame: data at 12, len at 6, flags at 4

canxl->len == 4 makes a 16-byte skb, which is CAN_MTU and passes
"skb->len != so->ll.mtu" on a Classic channel.  Cast to struct canfd_frame,
the byte at offset 4 is canxl->flags, and CANXL_XLF is 0x80 and mandatory,
so cf->len is 0xff in the run below.  The flow-control path uses that length
without bounding it, which is what check_pad() walks to 255 over.

Measured on v7.3-rc7 under QEMU/KVM on vcan with mtu 2060, two kernels from
one tree differing only in this hunk:

  A  a CAN XL frame with len 4 injected into a Classic socket with
     RX_PADDING | CHK_PAD_LEN | CHK_PAD_DATA:
       without the patch  recv() -> EBADMSG
       with the patch     no EBADMSG
  B  legitimate traffic and the padding check:
       CC ok-unpadded / ok-padded / wrong-padding    intact, intact, EBADMSG
       FD ok-unpadded / ok-padded / wrong-padding    intact, intact, EBADMSG
     identical on both kernels.

B matters because the guard sits in front of the code that reports bad
padding.  The wrong-padding cases still report EBADMSG on the patched
kernel, and the CAN FD channel is unaffected.

Reviewed-by: Quchaosheng <quchaosheng000406@xxxxxxx>