On 16/12/2024 at 15:58, Ming Yu wrote:

Dear Vincent,

Thank you for your comments,

Vincent Mailhol [off-list ref] 於 2024年12月11日 週三 下午11:25寫道：

(...)

quoted

quoted

quoted

+     cf->len = xmit->dlc;

what does xmit->dlc contain? The DLC or the length?

+1

Also, do not trust the device data. Even if SPI attacks are less
common, make sure to sanitize this length.

  cf->len = canfd_sanitize_len(xmit->dlc);

Or

  cf->len = canfd_sanitize_len(xmit->dlc);

if xmit->dlc is in fact a DLC.

Excuse me, the xmit->dlc is actual data length.
Does it need to be fixed?

Yes, name is xmit->len. DLC has a different meaning.


Yours sincerely,
Vincent Mailhol