Commit d7536931 authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'linux-can-fixes-for-6.4-20230605' of... 

Merge tag 'linux-can-fixes-for-6.4-20230605' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can



Marc Kleine-Budde says:

====================

this is a pull request of 3 patches for net/master.

All 3 patches target the j1939 stack.

The 1st patch is by Oleksij Rempel and fixes the error queue handling
for (E)TP sessions that run into timeouts.

The last 2 patches are by Fedor Pchelkin and fix a potential
use-after-free in j1939_netdev_start() if j1939_can_rx_register()
fails.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents cd2b8113 628f725d

net/can/j1939/main.c

+13 −11
Original line number Diff line number Diff line
@@ -126,7 +126,7 @@ static void j1939_can_recv(struct sk_buff *iskb, void *data) 
#define J1939_CAN_ID CAN_EFF_FLAG

#define J1939_CAN_MASK (CAN_EFF_FLAG | CAN_RTR_FLAG)



static DEFINE_SPINLOCK(j1939_netdev_lock);

static DEFINE_MUTEX(j1939_netdev_lock);



static struct j1939_priv *j1939_priv_create(struct net_device *ndev)

{
@@ -220,7 +220,7 @@ static void __j1939_rx_release(struct kref *kref) 
	j1939_can_rx_unregister(priv);

	j1939_ecu_unmap_all(priv);

	j1939_priv_set(priv->ndev, NULL);

	spin_unlock(&j1939_netdev_lock);

	mutex_unlock(&j1939_netdev_lock);

}



/* get pointer to priv without increasing ref counter */
@@ -248,9 +248,9 @@ static struct j1939_priv *j1939_priv_get_by_ndev(struct net_device *ndev) 
{

	struct j1939_priv *priv;



	spin_lock(&j1939_netdev_lock);

	mutex_lock(&j1939_netdev_lock);

	priv = j1939_priv_get_by_ndev_locked(ndev);

	spin_unlock(&j1939_netdev_lock);

	mutex_unlock(&j1939_netdev_lock);



	return priv;

}
@@ -260,14 +260,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) 
	struct j1939_priv *priv, *priv_new;

	int ret;



	spin_lock(&j1939_netdev_lock);

	mutex_lock(&j1939_netdev_lock);

	priv = j1939_priv_get_by_ndev_locked(ndev);

	if (priv) {

		kref_get(&priv->rx_kref);

		spin_unlock(&j1939_netdev_lock);

		mutex_unlock(&j1939_netdev_lock);

		return priv;

	}

	spin_unlock(&j1939_netdev_lock);

	mutex_unlock(&j1939_netdev_lock);



	priv = j1939_priv_create(ndev);

	if (!priv)
@@ -277,29 +277,31 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) 
	spin_lock_init(&priv->j1939_socks_lock);

	INIT_LIST_HEAD(&priv->j1939_socks);



	spin_lock(&j1939_netdev_lock);

	mutex_lock(&j1939_netdev_lock);

	priv_new = j1939_priv_get_by_ndev_locked(ndev);

	if (priv_new) {

		/* Someone was faster than us, use their priv and roll

		 * back our's.

		 */

		kref_get(&priv_new->rx_kref);

		spin_unlock(&j1939_netdev_lock);

		mutex_unlock(&j1939_netdev_lock);

		dev_put(ndev);

		kfree(priv);

		return priv_new;

	}

	j1939_priv_set(ndev, priv);

	spin_unlock(&j1939_netdev_lock);



	ret = j1939_can_rx_register(priv);

	if (ret < 0)

		goto out_priv_put;



	mutex_unlock(&j1939_netdev_lock);

	return priv;



 out_priv_put:

	j1939_priv_set(ndev, NULL);

	mutex_unlock(&j1939_netdev_lock);



	dev_put(ndev);

	kfree(priv);
@@ -308,7 +310,7 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) 


void j1939_netdev_stop(struct j1939_priv *priv)

{

	kref_put_lock(&priv->rx_kref, __j1939_rx_release, &j1939_netdev_lock);

	kref_put_mutex(&priv->rx_kref, __j1939_rx_release, &j1939_netdev_lock);

	j1939_priv_put(priv);

}

net/can/j1939/socket.c

+5 −0
Original line number Diff line number Diff line
@@ -1088,6 +1088,11 @@ void j1939_sk_errqueue(struct j1939_session *session, 


void j1939_sk_send_loop_abort(struct sock *sk, int err)

{

	struct j1939_sock *jsk = j1939_sk(sk);



	if (jsk->state & J1939_SOCK_ERRQUEUE)

		return;



	sk->sk_err = err;



	sk_error_report(sk);