commit 2e98b1fd8ca4bc70272dc56c321c6c08508fbeb7
author Henrik Brix Andersen <hebad@vestas.com> Tue Oct 24 22:16:11 2023 +0200
committer Chris Friedt <chrisfriedt@gmail.com> Thu Oct 26 09:34:14 2023 -0400
tree 180976dccc26a28e211cfb15096c858faca1d085
parent 13072b4c7b43d239d41cfc6e5d4d2bc9440a9287

drivers: can: be consistent in filter_id checks when removing rx filters

Change the CAN controller driver implementations for the
can_remove_rx_filter() API call to be consistent in their
validation of the supplied filter_id.

Fixes: #64398

Signed-off-by: Henrik Brix Andersen <hebad@vestas.com>

drivers/can/can_loopback.c

diff --git a/drivers/can/can_loopback.c b/drivers/can/can_loopback.c
index 8836b49..df17596 100644
--- a/drivers/can/can_loopback.c
+++ b/drivers/can/can_loopback.c
@@ -171,6 +171,11 @@
 {
 	struct can_loopback_data *data = DEV_DATA(dev);
 
+	if (filter_id < 0 || filter_id >= ARRAY_SIZE(data->filters)) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
+		return;
+	}
+
 	LOG_DBG("Detach filter ID: %d", filter_id);
 	k_mutex_lock(&data->mtx, K_FOREVER);
 	data->filters[filter_id].rx_cb = NULL;

drivers/can/can_mcan.c

diff --git a/drivers/can/can_mcan.c b/drivers/can/can_mcan.c
index 78ce165..77ebf46 100644
--- a/drivers/can/can_mcan.c
+++ b/drivers/can/can_mcan.c
@@ -894,11 +894,16 @@
 void can_mcan_detach(struct can_mcan_data *data,
 		     struct can_mcan_msg_sram *msg_ram, int filter_nr)
 {
+	if (filter_nr < 0) {
+		LOG_ERR("filter ID %d out of bounds", filter_nr);
+		return;
+	}
+
 	k_mutex_lock(&data->inst_mutex, K_FOREVER);
 	if (filter_nr >= NUM_STD_FILTER_DATA) {
 		filter_nr -= NUM_STD_FILTER_DATA;
 		if (filter_nr >= NUM_STD_FILTER_DATA) {
-			LOG_ERR("Wrong filter id");
+			LOG_ERR("filter ID %d out of bounds", filter_nr);
 			return;
 		}
 

drivers/can/can_mcp2515.c

diff --git a/drivers/can/can_mcp2515.c b/drivers/can/can_mcp2515.c
index 98bbde6..34b30b9 100644
--- a/drivers/can/can_mcp2515.c
+++ b/drivers/can/can_mcp2515.c
@@ -551,6 +551,11 @@
 {
 	struct mcp2515_data *dev_data = DEV_DATA(dev);
 
+	if (filter_nr < 0 || filter_nr >= CONFIG_CAN_MAX_FILTER) {
+		LOG_ERR("filter ID %d out of bounds", filter_nr);
+		return;
+	}
+
 	k_mutex_lock(&dev_data->mutex, K_FOREVER);
 	dev_data->filter_usage &= ~BIT(filter_nr);
 	k_mutex_unlock(&dev_data->mutex);

drivers/can/can_mcux_flexcan.c

diff --git a/drivers/can/can_mcux_flexcan.c b/drivers/can/can_mcux_flexcan.c
index 8854224..c51748b 100644
--- a/drivers/can/can_mcux_flexcan.c
+++ b/drivers/can/can_mcux_flexcan.c
@@ -480,9 +480,8 @@
 	const struct mcux_flexcan_config *config = dev->config;
 	struct mcux_flexcan_data *data = dev->data;
 
-	if (filter_id >= MCUX_FLEXCAN_MAX_RX) {
-		LOG_ERR("Detach: Filter id >= MAX_RX (%d >= %d)", filter_id,
-			MCUX_FLEXCAN_MAX_RX);
+	if (filter_id < 0 || filter_id >= MCUX_FLEXCAN_MAX_RX) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
 		return;
 	}
 

drivers/can/can_rcar.c

diff --git a/drivers/can/can_rcar.c b/drivers/can/can_rcar.c
index 31a53c2..66fcc4b 100644
--- a/drivers/can/can_rcar.c
+++ b/drivers/can/can_rcar.c
@@ -829,7 +829,8 @@
 {
 	struct can_rcar_data *data = DEV_CAN_DATA(dev);
 
-	if (filter_nr >= CONFIG_CAN_RCAR_MAX_FILTER) {
+	if (filter_nr < 0 || filter_nr >= CONFIG_CAN_RCAR_MAX_FILTER) {
+		LOG_ERR("filter ID %d out of bounds", filter_nr);
 		return;
 	}