[PATCH net v2 0/2] can: j1939: tighten TP receive-path checks

[Liu Chao]

j1939_xtp_rx_rts_session_new() allocates the receive buffer based on
the message size from RTS dat[1..2], but then overwrites pkt.total
with dat[3] even when they disagree.  A sender can set dat[3] smaller
so the session completes after fewer packets than the buffer was sized
for, delivering a short message to userspace.  With dat[3]=0 the
session just hangs until timeout.

eb96c5890792 ("can: j1939: transport: j1939_session_fresh_new():
initialize receive buffer") addressed a related symptom by zeroing the
receive buffer, but the root cause -- blindly trusting dat[3] -- is
still there.

Patch 1 aborts the session when dat[3] does not match.
Patch 2 adds a pkt.rx check in the EOMA handler for unicast receive
sessions (BAM completes via the final flag in j1939_xtp_rx_dat_one,
not through EOMA).

Note: The handling of sessions already in WAITING_ABORT in
j1939_session_cancel() is fragile in general -- the cts_one and
dat_one cancel paths carry the same hazard unguarded.  The pre-existing
AB-BA deadlock between active_session_list_lock and the rxtimer callback
is likewise not addressed; this series does not change the locking.
Both belong in separate patches.

v2:
  - keep the EOMA size-mismatch warning for transmitter sessions (was
    inadvertently suppressed in v1 by the !session->transmission guard)
  - guard out_session_cancel against J1939_SESSION_WAITING_ABORT state
  - add 'net' to subject prefix
  - use netdev_warn_once for the new warnings to limit log spam from
    malicious frames
  - fix format specifiers: %u for unsigned, %d for int
  - drop redundant dat[3] == 0 check (a zero count already fails the
    != pkt.total test, since pkt.total >= 2 for TP)
  - patch 1: explain why neither direction of mismatch works today

  The first two items address the sashiko-bot review of patch 2:
  https://lore.kernel.org/all/20260908145715.D70BD1F00A3D@xxxxxxxxxxxxxxx/

v1: https://lore.kernel.org/all/20260907145640.1106170-1-liuc63@xxxxxxxxxxxx/

Liu Chao (2):
  can: j1939: reject TP RTS with wrong packet count
  can: j1939: check received packet count before completing session

 net/can/j1939/transport.c | 41 +++++++++++++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 6 deletions(-)

-- 
2.50.1