Commit 1348b001 authored by Oleksij Rempel's avatar Oleksij Rempel Committed by Zhengchao Shao
Browse files

net: can: j1939: enhanced error handling for tightly received RTS messages in... 

net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new

stable inclusion
from stable-v5.10.221
commit f6c839e717901dbd6b1c1ca807b6210222eb70f6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAH95F
CVE: CVE-2023-52887

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f6c839e717901dbd6b1c1ca807b6210222eb70f6



---------------------------

commit d3e2904f71ea0fe7eaff1d68a2b0363c888ea0fb upstream.

This patch enhances error handling in scenarios with RTS (Request to
Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE
backtraces with a new error handling method. This provides clearer error
messages and allows for the early termination of problematic sessions.
Previously, sessions were only released at the end of j1939_xtp_rx_rts().

Potentially this could be reproduced with something like:
testj1939 -r vcan0:0x80 &
while true; do
	# send first RTS
	cansend vcan0 18EC8090#1014000303002301;
	# send second RTS
	cansend vcan0 18EC8090#1014000303002301;
	# send abort
	cansend vcan0 18EC8090#ff00000000002301;
done

Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
Reported-by: default avatar <syzbot+daa36413a5cedf799ae4@syzkaller.appspotmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/all/20231117124959.961171-1-o.rempel@pengutronix.de


Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent 4a618915

net/can/j1939/transport.c

+17 −2
Original line number Diff line number Diff line
@@ -1577,8 +1577,8 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, 
	struct j1939_sk_buff_cb skcb = *j1939_skb_to_cb(skb);

	struct j1939_session *session;

	const u8 *dat;

	int len, ret;

	pgn_t pgn;

	int len;



	netdev_dbg(priv->ndev, "%s\n", __func__);
@@ -1634,7 +1634,22 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, 
	session->pkt.rx = 0;

	session->pkt.tx = 0;



	WARN_ON_ONCE(j1939_session_activate(session));

	ret = j1939_session_activate(session);

	if (ret) {

		/* Entering this scope indicates an issue with the J1939 bus.

		 * Possible scenarios include:

		 * - A time lapse occurred, and a new session was initiated

		 *   due to another packet being sent correctly. This could

		 *   have been caused by too long interrupt, debugger, or being

		 *   out-scheduled by another task.

		 * - The bus is receiving numerous erroneous packets, either

		 *   from a malfunctioning device or during a test scenario.

		 */

		netdev_alert(priv->ndev, "%s: 0x%p: concurrent session with same addr (%02x %02x) is already active.\n",

			     __func__, session, skcb.addr.sa, skcb.addr.da);

		j1939_session_put(session);

		return NULL;

	}



	return session;

}