Commit 6d072066 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'linux-can-fixes-for-5.17-20220209' of... 

Merge tag 'linux-can-fixes-for-5.17-20220209' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can



Marc Kleine-Budde says:

====================
pull-request: can 2022-02-09

this is a pull request of 2 patches for net/master.

Oliver Hartkopp contributes 2 fixes for the CAN ISOTP protocol.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 7ec02f5a 8375dfac

net/can/isotp.c

+22 −7
Original line number Diff line number Diff line
@@ -56,6 +56,7 @@ 
#include <linux/module.h>

#include <linux/init.h>

#include <linux/interrupt.h>

#include <linux/spinlock.h>

#include <linux/hrtimer.h>

#include <linux/wait.h>

#include <linux/uio.h>
@@ -145,6 +146,7 @@ struct isotp_sock { 
	struct tpcon rx, tx;

	struct list_head notifier;

	wait_queue_head_t wait;

	spinlock_t rx_lock; /* protect single thread state machine */

};



static LIST_HEAD(isotp_notifier_list);
@@ -615,11 +617,17 @@ static void isotp_rcv(struct sk_buff *skb, void *data) 


	n_pci_type = cf->data[ae] & 0xF0;



	/* Make sure the state changes and data structures stay consistent at

	 * CAN frame reception time. This locking is not needed in real world

	 * use cases but the inconsistency can be triggered with syzkaller.

	 */

	spin_lock(&so->rx_lock);



	if (so->opt.flags & CAN_ISOTP_HALF_DUPLEX) {

		/* check rx/tx path half duplex expectations */

		if ((so->tx.state != ISOTP_IDLE && n_pci_type != N_PCI_FC) ||

		    (so->rx.state != ISOTP_IDLE && n_pci_type == N_PCI_FC))

			return;

			goto out_unlock;

	}



	switch (n_pci_type) {
@@ -668,6 +676,9 @@ static void isotp_rcv(struct sk_buff *skb, void *data) 
		isotp_rcv_cf(sk, cf, ae, skb);

		break;

	}



out_unlock:

	spin_unlock(&so->rx_lock);

}



static void isotp_fill_dataframe(struct canfd_frame *cf, struct isotp_sock *so,
@@ -876,7 +887,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 


	if (!size || size > MAX_MSG_LENGTH) {

		err = -EINVAL;

		goto err_out;

		goto err_out_drop;

	}



	/* take care of a potential SF_DL ESC offset for TX_DL > 8 */
@@ -886,24 +897,24 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 
	if ((so->opt.flags & CAN_ISOTP_SF_BROADCAST) &&

	    (size > so->tx.ll_dl - SF_PCI_SZ4 - ae - off)) {

		err = -EINVAL;

		goto err_out;

		goto err_out_drop;

	}



	err = memcpy_from_msg(so->tx.buf, msg, size);

	if (err < 0)

		goto err_out;

		goto err_out_drop;



	dev = dev_get_by_index(sock_net(sk), so->ifindex);

	if (!dev) {

		err = -ENXIO;

		goto err_out;

		goto err_out_drop;

	}



	skb = sock_alloc_send_skb(sk, so->ll.mtu + sizeof(struct can_skb_priv),

				  msg->msg_flags & MSG_DONTWAIT, &err);

	if (!skb) {

		dev_put(dev);

		goto err_out;

		goto err_out_drop;

	}



	can_skb_reserve(skb);
@@ -965,7 +976,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 
	if (err) {

		pr_notice_once("can-isotp: %s: can_send_ret %pe\n",

			       __func__, ERR_PTR(err));

		goto err_out;

		goto err_out_drop;

	}



	if (wait_tx_done) {
@@ -978,6 +989,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 


	return size;



err_out_drop:

	/* drop this PDU and unlock a potential wait queue */

	old_state = ISOTP_IDLE;

err_out:

	so->tx.state = old_state;

	if (so->tx.state == ISOTP_IDLE)
@@ -1444,6 +1458,7 @@ static int isotp_init(struct sock *sk) 
	so->txtimer.function = isotp_tx_timer_handler;



	init_waitqueue_head(&so->wait);

	spin_lock_init(&so->rx_lock);



	spin_lock(&isotp_notifier_lock);

	list_add_tail(&so->notifier, &isotp_notifier_list);