linux-kernel - [PATCH] cangen: flush the CAN frame at each iteration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20201101145712.489795-1-mailhol.vincent@wanadoo.fr>
Date:   Sun,  1 Nov 2020 23:57:12 +0900
From:   Vincent Mailhol <mailhol.vincent@...adoo.fr>
To:     linux-kernel@...r.kernel.org,
        Oliver Hartkopp <socketcan@...tkopp.net>
Cc:     Marc Kleine-Budde <mkl@...gutronix.de>,
        Vincent Mailhol <mailhol.vincent@...adoo.fr>
Subject: [PATCH] cangen: flush the CAN frame at each iteration

The variable 'frame' is declared on the stack and is reused at each
iteration of the while loop.

If not flushed, garbage data from the previous iteration of the loop
could remain causing unexpected behavior. This is the case in DLC
random mode: the field frame.len8_dlc is not cleared when the dlc is
exactly 8 and the len8_dlc value of the previous iteration will be
sent again.

This can be observed by running 'cangen -8 can0'. Once a frame of DLC
in the range 9..15 is generated, no more frames of DLC 8 show out in
the log.

Signed-off-by: Vincent Mailhol <mailhol.vincent@...adoo.fr>
---
 cangen.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cangen.c b/cangen.c
index ab8122c..d7392b6 100644
--- a/cangen.c
+++ b/cangen.c
@@ -384,7 +384,7 @@ int main(int argc, char **argv)
 	}

 	while (running) {
-		frame.flags = 0;
+		memset(&frame, 0, sizeof(frame));

 		if (count && (--count == 0))
 			running = 0;
-- 
2.26.2