Commit Graph

93 Commits

Author SHA1 Message Date
Radu Rendec c6f86d2685 can: raw: raw_getsockopt(): reduce scope of err
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 00bf80c437dcbbd808d61cc2866c8f065ff436bd
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Tue Feb 20 09:16:16 2024 +0100

    can: raw: raw_getsockopt(): reduce scope of err

    Reduce the scope of the variable "err" to the individual cases. This
    is to avoid the mistake of setting "err" in the mistaken belief that
    it will be evaluated later.

    Reviewed-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
    Link: https://lore.kernel.org/all/20240220-raw-setsockopt-v1-1-7d34cb1377fc@pengutronix.de
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:54 -04:00
Radu Rendec 3b84535929 can: raw: fix getsockopt() for new CAN_RAW_XL_VCID_OPTS
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit c8fba5d6df5e476aa791db4f1f014dad2bb5e904
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Mon Feb 19 21:00:21 2024 +0100

    can: raw: fix getsockopt() for new CAN_RAW_XL_VCID_OPTS

    The code for the CAN_RAW_XL_VCID_OPTS getsockopt() was incompletely adopted
    from the CAN_RAW_FILTER getsockopt().

    Add the missing put_user() and return statements.

    Flagged by Smatch.

    Fixes: c83c22ec1493 ("can: canxl: add virtual CAN network identifier support")
    Reported-by: Simon Horman <horms@kernel.org>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20240219200021.12113-1-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:54 -04:00
Radu Rendec 0e7ac30544 can: canxl: add virtual CAN network identifier support
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit c83c22ec1493c0b7cc77327bedbd387e295872b6
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Mon Feb 12 22:35:50 2024 +0100

    can: canxl: add virtual CAN network identifier support

    CAN XL data frames contain an 8-bit virtual CAN network identifier (VCID).
    A VCID value of zero represents an 'untagged' CAN XL frame.

    To receive and send these optional VCIDs via CAN_RAW sockets a new socket
    option CAN_RAW_XL_VCID_OPTS is introduced to define/access VCID content:

    - tx: set the outgoing VCID value by the kernel (one fixed 8-bit value)
    - tx: pass through VCID values from the user space (e.g. for traffic replay)
    - rx: apply VCID receive filter (value/mask) to be passed to the user space

    With the 'tx pass through' option CAN_RAW_XL_VCID_TX_PASS all valid VCID
    values can be sent, e.g. to replay full qualified CAN XL traffic.

    The VCID value provided for the CAN_RAW_XL_VCID_TX_SET option will
    override the VCID value in the struct canxl_frame.prio defined for
    CAN_RAW_XL_VCID_TX_PASS when both flags are set.

    With a rx_vcid_mask of zero all possible VCID values (0x00 - 0xFF) are
    passed to the user space when the CAN_RAW_XL_VCID_RX_FILTER flag is set.
    Without this flag only untagged CAN XL frames (VCID = 0x00) are delivered
    to the user space (default).

    The 8-bit VCID is stored inside the CAN XL prio element (only in CAN XL
    frames!) to not interfere with other CAN content or the CAN filters
    provided by the CAN_RAW sockets and kernel infrastruture.

    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20240212213550.18516-1-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:54 -04:00
Radu Rendec cafb31aad3 can: raw: Remove NULL check before dev_{put, hold}
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit dd8bb80308c474ea0e7ddb244962cb2d7001bae2
Author: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date:   Fri Aug 25 14:46:56 2023 +0800

    can: raw: Remove NULL check before dev_{put, hold}

    The call netdev_{put, hold} of dev_{put, hold} will check NULL, so there
    is no need to check before using dev_{put, hold}, remove it to silence
    the warning:

    ./net/can/raw.c:497:2-9: WARNING: NULL check before dev_{put, hold} functions is not needed.

    Reported-by: Abaci Robot <abaci@linux.alibaba.com>
    Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=6231
    Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
    Reported-by: Simon Horman <horms@kernel.org>
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20230825064656.87751-1-jiapeng.chong@linux.alibaba.com
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:54 -04:00
Radu Rendec 00dd42aa89 can: raw: add missing refcount for memory leak fix
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit c275a176e4b69868576e543409927ae75e3a3288
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Mon Aug 21 16:45:47 2023 +0200

    can: raw: add missing refcount for memory leak fix

    Commit ee8b94c8510c ("can: raw: fix receiver memory leak") introduced
    a new reference to the CAN netdevice that has assigned CAN filters.
    But this new ro->dev reference did not maintain its own refcount which
    lead to another KASAN use-after-free splat found by Eric Dumazet.

    This patch ensures a proper refcount for the CAN nedevice.

    Fixes: ee8b94c8510c ("can: raw: fix receiver memory leak")
    Reported-by: Eric Dumazet <edumazet@google.com>
    Cc: Ziyang Xuan <william.xuanziyang@huawei.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/r/20230821144547.6658-3-socketcan@hartkopp.net
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:53 -04:00
Radu Rendec 687cf4fabc can: raw: fix lockdep issue in raw_release()
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 11c9027c983e9e4b408ee5613b6504d24ebd85be
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Jul 20 11:44:38 2023 +0000

    can: raw: fix lockdep issue in raw_release()

    syzbot complained about a lockdep issue [1]

    Since raw_bind() and raw_setsockopt() first get RTNL
    before locking the socket, we must adopt the same order in raw_release()

    [1]
    WARNING: possible circular locking dependency detected
    6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0 Not tainted
    ------------------------------------------------------
    syz-executor.0/14110 is trying to acquire lock:
    ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1708 [inline]
    ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: raw_bind+0xb1/0xab0 net/can/raw.c:435

    but task is already holding lock:
    ffffffff8e3df368 (rtnl_mutex){+.+.}-{3:3}, at: raw_bind+0xa7/0xab0 net/can/raw.c:434

    which lock already depends on the new lock.

    the existing dependency chain (in reverse order) is:

    -> #1 (rtnl_mutex){+.+.}-{3:3}:
    __mutex_lock_common kernel/locking/mutex.c:603 [inline]
    __mutex_lock+0x181/0x1340 kernel/locking/mutex.c:747
    raw_release+0x1c6/0x9b0 net/can/raw.c:391
    __sock_release+0xcd/0x290 net/socket.c:654
    sock_close+0x1c/0x20 net/socket.c:1386
    __fput+0x3fd/0xac0 fs/file_table.c:384
    task_work_run+0x14d/0x240 kernel/task_work.c:179
    resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
    exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
    exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204
    __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
    syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
    do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

    -> #0 (sk_lock-AF_CAN){+.+.}-{0:0}:
    check_prev_add kernel/locking/lockdep.c:3142 [inline]
    check_prevs_add kernel/locking/lockdep.c:3261 [inline]
    validate_chain kernel/locking/lockdep.c:3876 [inline]
    __lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144
    lock_acquire kernel/locking/lockdep.c:5761 [inline]
    lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726
    lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492
    lock_sock include/net/sock.h:1708 [inline]
    raw_bind+0xb1/0xab0 net/can/raw.c:435
    __sys_bind+0x1ec/0x220 net/socket.c:1792
    __do_sys_bind net/socket.c:1803 [inline]
    __se_sys_bind net/socket.c:1801 [inline]
    __x64_sys_bind+0x72/0xb0 net/socket.c:1801
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

    other info that might help us debug this:

    Possible unsafe locking scenario:

    CPU0 CPU1
    ---- ----
    lock(rtnl_mutex);
            lock(sk_lock-AF_CAN);
            lock(rtnl_mutex);
    lock(sk_lock-AF_CAN);

    *** DEADLOCK ***

    1 lock held by syz-executor.0/14110:

    stack backtrace:
    CPU: 0 PID: 14110 Comm: syz-executor.0 Not tainted 6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
    Call Trace:
    <TASK>
    __dump_stack lib/dump_stack.c:88 [inline]
    dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
    check_noncircular+0x311/0x3f0 kernel/locking/lockdep.c:2195
    check_prev_add kernel/locking/lockdep.c:3142 [inline]
    check_prevs_add kernel/locking/lockdep.c:3261 [inline]
    validate_chain kernel/locking/lockdep.c:3876 [inline]
    __lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144
    lock_acquire kernel/locking/lockdep.c:5761 [inline]
    lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726
    lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492
    lock_sock include/net/sock.h:1708 [inline]
    raw_bind+0xb1/0xab0 net/can/raw.c:435
    __sys_bind+0x1ec/0x220 net/socket.c:1792
    __do_sys_bind net/socket.c:1803 [inline]
    __se_sys_bind net/socket.c:1801 [inline]
    __x64_sys_bind+0x72/0xb0 net/socket.c:1801
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x63/0xcd
    RIP: 0033:0x7fd89007cb29
    Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
    RSP: 002b:00007fd890d2a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031
    RAX: ffffffffffffffda RBX: 00007fd89019bf80 RCX: 00007fd89007cb29
    RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003
    RBP: 00007fd8900c847a R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
    R13: 000000000000000b R14: 00007fd89019bf80 R15: 00007ffebf8124f8
    </TASK>

    Fixes: ee8b94c8510c ("can: raw: fix receiver memory leak")
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Ziyang Xuan <william.xuanziyang@huawei.com>
    Cc: Oliver Hartkopp <socketcan@hartkopp.net>
    Cc: stable@vger.kernel.org
    Cc: Marc Kleine-Budde <mkl@pengutronix.de>
    Link: https://lore.kernel.org/all/20230720114438.172434-1-edumazet@google.com
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:53 -04:00
Radu Rendec fd097ae831 can: raw: fix receiver memory leak
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit ee8b94c8510ce64afe0b87ef548d23e00915fb10
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Tue Jul 11 09:17:37 2023 +0800

    can: raw: fix receiver memory leak

    Got kmemleak errors with the following ltp can_filter testcase:

    for ((i=1; i<=100; i++))
    do
            ./can_filter &
            sleep 0.1
    done

    ==============================================================
    [<00000000db4a4943>] can_rx_register+0x147/0x360 [can]
    [<00000000a289549d>] raw_setsockopt+0x5ef/0x853 [can_raw]
    [<000000006d3d9ebd>] __sys_setsockopt+0x173/0x2c0
    [<00000000407dbfec>] __x64_sys_setsockopt+0x61/0x70
    [<00000000fd468496>] do_syscall_64+0x33/0x40
    [<00000000b7e47d51>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

    It's a bug in the concurrent scenario of unregister_netdevice_many()
    and raw_release() as following:

                 cpu0                                        cpu1
    unregister_netdevice_many(can_dev)
      unlist_netdevice(can_dev) // dev_get_by_index() return NULL after this
      net_set_todo(can_dev)
                                                    raw_release(can_socket)
                                                      dev = dev_get_by_index(, ro->ifindex); // dev == NULL
                                                      if (dev) { // receivers in dev_rcv_lists not free because dev is NULL
                                                        raw_disable_allfilters(, dev, );
                                                        dev_put(dev);
                                                      }
                                                      ...
                                                      ro->bound = 0;
                                                      ...

    call_netdevice_notifiers(NETDEV_UNREGISTER, )
      raw_notify(, NETDEV_UNREGISTER, )
        if (ro->bound) // invalid because ro->bound has been set 0
          raw_disable_allfilters(, dev, ); // receivers in dev_rcv_lists will never be freed

    Add a net_device pointer member in struct raw_sock to record bound
    can_dev, and use rtnl_lock to serialize raw_socket members between
    raw_bind(), raw_release(), raw_setsockopt() and raw_notify(). Use
    ro->dev to decide whether to free receivers in dev_rcv_lists.

    Fixes: 8d0caedb75 ("can: bcm/raw/isotp: use per module netdevice notifier")
    Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Link: https://lore.kernel.org/all/20230711011737.1969582-1-william.xuanziyang@huawei.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:53 -04:00
Radu Rendec e400339d54 can: raw: use temp variable instead of rolling back config
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit f2f527d595963aa86464ca3e05ec27dd5153d56e
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Fri Feb 3 10:08:07 2023 +0100

    can: raw: use temp variable instead of rolling back config

    Introduce a temporary variable to check for an invalid configuration
    attempt from user space. Before this patch the value was copied to
    the real config variable and rolled back in the case of an error.

    Suggested-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20230203090807.97100-1-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:52 -04:00
Radu Rendec 83b0a90b04 can: raw: fix CAN FD frame transmissions over CAN XL devices
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 3793301cbaa4a62d83e21f685307da7671f812ab
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Tue Jan 31 11:56:13 2023 +0100

    can: raw: fix CAN FD frame transmissions over CAN XL devices

    A CAN XL device is always capable to process CAN FD frames. The former
    check when sending CAN FD frames relied on the existence of a CAN FD
    device and did not check for a CAN XL device that would be correct
    too.

    With this patch the CAN FD feature is enabled automatically when CAN
    XL is switched on - and CAN FD cannot be switch off while CAN XL is
    enabled.

    This precondition also leads to a clean up and reduction of checks in
    the hot path in raw_rcv() and raw_sendmsg(). Some conditions are
    reordered to handle simple checks first.

    changes since v1: https://lore.kernel.org/all/20230131091012.50553-1-socketcan@hartkopp.net
    - fixed typo: devive -> device
    changes since v2: https://lore.kernel.org/all/20230131091824.51026-1-socketcan@hartkopp.net/
    - reorder checks in if statements to handle simple checks first

    Fixes: 626332696d75 ("can: raw: add CAN XL support")
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20230131105613.55228-1-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:52 -04:00
Radu Rendec 4024a7cafc can: raw: add support for SO_MARK
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 0826e82b8a32e646b7b32ba8b68ba30812028e47
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Fri Dec 9 10:10:08 2022 +0100

    can: raw: add support for SO_MARK

    Add support for SO_MARK to the CAN_RAW protocol. This makes it
    possible to add traffic control filters based on the fwmark.

    Link: https://lore.kernel.org/all/20221210113653.170346-1-mkl@pengutronix.de
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:52 -04:00
Radu Rendec 7c54967c76 can: raw: add CAN XL support
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 626332696d7506e8f844a564277bdba2dc78fcb5
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Mon Sep 12 19:07:25 2022 +0200

    can: raw: add CAN XL support

    Enable CAN_RAW sockets to read and write CAN XL frames analogue to the
    CAN FD extension (new CAN_RAW_XL_FRAMES sockopt).

    A CAN XL network interface is capable to handle Classical CAN, CAN FD and
    CAN XL frames. When CAN_RAW_XL_FRAMES is enabled, the CAN_RAW socket checks
    whether the addressed CAN network interface is capable to handle the
    provided CAN frame.

    In opposite to the fixed number of bytes for
    - CAN frames (CAN_MTU = sizeof(struct can_frame))
    - CAN FD frames (CANFD_MTU = sizeof(struct can_frame))
    the number of bytes when reading/writing CAN XL frames depends on the
    number of data bytes. For efficiency reasons the length of the struct
    canxl_frame is truncated to the needed size for read/write operations.
    This leads to a calculated size of CANXL_HDR_SIZE + canxl_frame::len which
    is enforced on write() operations and guaranteed on read() operations.

    NB: Valid length values are 1 .. 2048 (CANXL_MIN_DLEN .. CANXL_MAX_DLEN).

    Acked-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20220912170725.120748-8-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:51 -04:00
Radu Rendec c6a06e07bb can: raw: use guard clause to optimize nesting in raw_rcv()
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 170277c532780392051fee48260896ed280cfbef
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Sat Aug 27 15:20:11 2022 +0800

    can: raw: use guard clause to optimize nesting in raw_rcv()

    We can use guard clause to optimize nesting codes like
    if (condition) { ... } else { return; } in raw_rcv();

    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Link: https://lore.kernel.org/all/0170ad1f07dbe838965df4274fce950980fa9d1f.1661584485.git.william.xuanziyang@huawei.com
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:51 -04:00
Radu Rendec dd8c631623 can: raw: process optimization in raw_init()
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit c28b3bffe49e713ce67f0e36de13b8f9f0776837
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Sat Aug 27 15:20:10 2022 +0800

    can: raw: process optimization in raw_init()

    Now, register notifier after register proto successfully. It can create
    raw socket and set socket options once register proto successfully, so it
    is possible missing notifier event before register notifier successfully
    although this is a low probability scenario.

    Move notifier registration to the front of proto registration like done
    in j1939. In addition, register_netdevice_notifier() may fail, check its
    result is necessary.

    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Link: https://lore.kernel.org/all/7af9401f0d2d9fed36c1667b5ac9b8df8f8b87ee.1661584485.git.william.xuanziyang@huawei.com
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:51 -04:00
Radu Rendec 546e511a7d can: raw: add support for SO_TXTIME/SCM_TXTIME
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 51a0d5e51178fcd147c1b8fdab2ed16b561326db
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Thu Apr 21 12:31:52 2022 +0200

    can: raw: add support for SO_TXTIME/SCM_TXTIME

    This patch calls into sock_cmsg_send() to parse the user supplied
    control information into a struct sockcm_cookie. Then assign the
    requested transmit time to the skb.

    This makes it possible to use the Earliest TXTIME First (ETF) packet
    scheduler with the CAN_RAW protocol. The user can send a CAN_RAW frame
    with a TXTIME and the kernel (with the ETF scheduler) will take care
    of sending it to the network interface.

    Link: https://lore.kernel.org/all/20220502091946.1916211-3-mkl@pengutronix.de
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:51 -04:00
Radu Rendec 25d3d309d8 can: raw: raw_sendmsg(): remove not needed setting of skb->sk
JIRA: https://issues.redhat.com/browse/RHEL-84144

commit 2af84932b3a1db29e37b10ef7f268da47489eb16
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Thu Apr 21 10:29:03 2022 +0200

    can: raw: raw_sendmsg(): remove not needed setting of skb->sk

    The skb in raw_sendmsg() is allocated with sock_alloc_send_skb(),
    which subsequently calls sock_alloc_send_pskb() -> skb_set_owner_w(),
    which assigns "skb->sk = sk".

    This patch removes the not needed setting of skb->sk.

    Link: https://lore.kernel.org/all/20220502091946.1916211-2-mkl@pengutronix.de
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Radu Rendec <rrendec@redhat.com>
2025-03-19 15:14:51 -04:00
Íñigo Huguet e24462420c net: remove noblock parameter from skb_recv_datagram()
Bugzilla: https://bugzilla.redhat.com/2143360

Conflicts:
 - isotp: missing many commits, such as:
   30ffd5332e06 ("can: isotp: return -EADDRNOTAVAIL when reading from unbound socket")
   42bf50a1795a ("can: isotp: support MSG_TRUNC flag when reading from socket")
   e382fea8ae54 ("can: isotp: restore accidentally removed MSG_PEEK feature")
 - removed chunks of non existent net/mctp

commit f4b41f062c424209e3939a81e6da022e049a45f2
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Mon Apr 4 18:30:22 2022 +0200

    net: remove noblock parameter from skb_recv_datagram()
    
    skb_recv_datagram() has two parameters 'flags' and 'noblock' that are
    merged inside skb_recv_datagram() by 'flags | (noblock ? MSG_DONTWAIT : 0)'
    
    As 'flags' may contain MSG_DONTWAIT as value most callers split the 'flags'
    into 'flags' and 'noblock' with finally obsolete bit operations like this:
    
    skb_recv_datagram(sk, flags & ~MSG_DONTWAIT, flags & MSG_DONTWAIT, &rc);
    
    And this is not even done consistently with the 'flags' parameter.
    
    This patch removes the obsolete and costly splitting into two parameters
    and only performs bit operations when really needed on the caller side.
    
    One missing conversion thankfully reported by kernel test robot. I missed
    to enable kunit tests to build the mctp code.
    
    Reported-by: kernel test robot <lkp@intel.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
2022-11-18 11:18:14 +01:00
Petr Oros ea6b084bc4 net: Remove redundant if statements
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2037315

Upstream commit(s):
commit 1160dfa178eb848327e9dec39960a735f4dc1685
Author: Yajun Deng <yajun.deng@linux.dev>
Date:   Thu Aug 5 19:55:27 2021 +0800

    net: Remove redundant if statements

    The 'if (dev)' statement already move into dev_{put , hold}, so remove
    redundant if statements.

    Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
    Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Petr Oros <poros@redhat.com>
2022-01-10 16:20:08 +01:00
Ziyang Xuan 54f93336d0 can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
We get a bug during ltp can_filter test as following.

===========================================
[60919.264984] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[60919.265223] PGD 8000003dda726067 P4D 8000003dda726067 PUD 3dda727067 PMD 0
[60919.265443] Oops: 0000 [#1] SMP PTI
[60919.265550] CPU: 30 PID: 3638365 Comm: can_filter Kdump: loaded Tainted: G        W         4.19.90+ #1
[60919.266068] RIP: 0010:selinux_socket_sock_rcv_skb+0x3e/0x200
[60919.293289] RSP: 0018:ffff8d53bfc03cf8 EFLAGS: 00010246
[60919.307140] RAX: 0000000000000000 RBX: 000000000000001d RCX: 0000000000000007
[60919.320756] RDX: 0000000000000001 RSI: ffff8d5104a8ed00 RDI: ffff8d53bfc03d30
[60919.334319] RBP: ffff8d9338056800 R08: ffff8d53bfc29d80 R09: 0000000000000001
[60919.347969] R10: ffff8d53bfc03ec0 R11: ffffb8526ef47c98 R12: ffff8d53bfc03d30
[60919.350320] perf: interrupt took too long (3063 > 2500), lowering kernel.perf_event_max_sample_rate to 65000
[60919.361148] R13: 0000000000000001 R14: ffff8d53bcf90000 R15: 0000000000000000
[60919.361151] FS:  00007fb78b6b3600(0000) GS:ffff8d53bfc00000(0000) knlGS:0000000000000000
[60919.400812] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[60919.413730] CR2: 0000000000000010 CR3: 0000003e3f784006 CR4: 00000000007606e0
[60919.426479] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[60919.439339] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[60919.451608] PKRU: 55555554
[60919.463622] Call Trace:
[60919.475617]  <IRQ>
[60919.487122]  ? update_load_avg+0x89/0x5d0
[60919.498478]  ? update_load_avg+0x89/0x5d0
[60919.509822]  ? account_entity_enqueue+0xc5/0xf0
[60919.520709]  security_sock_rcv_skb+0x2a/0x40
[60919.531413]  sk_filter_trim_cap+0x47/0x1b0
[60919.542178]  ? kmem_cache_alloc+0x38/0x1b0
[60919.552444]  sock_queue_rcv_skb+0x17/0x30
[60919.562477]  raw_rcv+0x110/0x190 [can_raw]
[60919.572539]  can_rcv_filter+0xbc/0x1b0 [can]
[60919.582173]  can_receive+0x6b/0xb0 [can]
[60919.591595]  can_rcv+0x31/0x70 [can]
[60919.600783]  __netif_receive_skb_one_core+0x5a/0x80
[60919.609864]  process_backlog+0x9b/0x150
[60919.618691]  net_rx_action+0x156/0x400
[60919.627310]  ? sched_clock_cpu+0xc/0xa0
[60919.635714]  __do_softirq+0xe8/0x2e9
[60919.644161]  do_softirq_own_stack+0x2a/0x40
[60919.652154]  </IRQ>
[60919.659899]  do_softirq.part.17+0x4f/0x60
[60919.667475]  __local_bh_enable_ip+0x60/0x70
[60919.675089]  __dev_queue_xmit+0x539/0x920
[60919.682267]  ? finish_wait+0x80/0x80
[60919.689218]  ? finish_wait+0x80/0x80
[60919.695886]  ? sock_alloc_send_pskb+0x211/0x230
[60919.702395]  ? can_send+0xe5/0x1f0 [can]
[60919.708882]  can_send+0xe5/0x1f0 [can]
[60919.715037]  raw_sendmsg+0x16d/0x268 [can_raw]

It's because raw_setsockopt() concurrently with
unregister_netdevice_many(). Concurrent scenario as following.

	cpu0						cpu1
raw_bind
raw_setsockopt					unregister_netdevice_many
						unlist_netdevice
dev_get_by_index				raw_notifier
raw_enable_filters				......
can_rx_register
can_rcv_list_find(..., net->can.rx_alldev_list)

......

sock_close
raw_release(sock_a)

......

can_receive
can_rcv_filter(net->can.rx_alldev_list, ...)
raw_rcv(skb, sock_a)
BUG

After unlist_netdevice(), dev_get_by_index() return NULL in
raw_setsockopt(). Function raw_enable_filters() will add sock
and can_filter to net->can.rx_alldev_list. Then the sock is closed.
Followed by, we sock_sendmsg() to a new vcan device use the same
can_filter. Protocol stack match the old receiver whose sock has
been released on net->can.rx_alldev_list in can_rcv_filter().
Function raw_rcv() uses the freed sock. UAF BUG is triggered.

We can find that the key issue is that net_device has not been
protected in raw_setsockopt(). Use rtnl_lock to protect net_device
in raw_setsockopt().

Fixes: c18ce101f2 ("[CAN]: Add raw protocol")
Link: https://lore.kernel.org/r/20210722070819.1048263-1-william.xuanziyang@huawei.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-07-24 19:00:14 +02:00
Alexander Aring e3ae2365ef net: sock: introduce sk_error_report
This patch introduces a function wrapper to call the sk_error_report
callback. That will prepare to add additional handling whenever
sk_error_report is called, for example to trace socket errors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-06-29 11:28:21 -07:00
Tetsuo Handa 8d0caedb75 can: bcm/raw/isotp: use per module netdevice notifier
syzbot is reporting hung task at register_netdevice_notifier() [1] and
unregister_netdevice_notifier() [2], for cleanup_net() might perform
time consuming operations while CAN driver's raw/bcm/isotp modules are
calling {register,unregister}_netdevice_notifier() on each socket.

Change raw/bcm/isotp modules to call register_netdevice_notifier() from
module's __init function and call unregister_netdevice_notifier() from
module's __exit function, as with gw/j1939 modules are doing.

Link: https://syzkaller.appspot.com/bug?id=391b9498827788b3cc6830226d4ff5be87107c30 [1]
Link: https://syzkaller.appspot.com/bug?id=1724d278c83ca6e6df100a2e320c10d991cf2bce [2]
Link: https://lore.kernel.org/r/54a5f451-05ed-f977-8534-79e7aa2bcc8f@i-love.sakura.ne.jp
Cc: linux-stable <stable@vger.kernel.org>
Reported-by: syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+0f1827363a305f74996f@syzkaller.appspotmail.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Tested-by: syzbot <syzbot+355f8edb2ff45d5f95fa@syzkaller.appspotmail.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-06-16 12:52:18 +02:00
Oliver Hartkopp 9e9714742f can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
Since commit f5223e9eee ("can: extend sockaddr_can to include j1939
members") the sockaddr_can has been extended in size and a new
CAN_REQUIRED_SIZE macro has been introduced to calculate the protocol
specific needed size.

The ABI for the msg_name and msg_namelen has not been adapted to the
new CAN_REQUIRED_SIZE macro for the other CAN protocols which leads to
a problem when an existing binary reads the (increased) struct
sockaddr_can in msg_name.

Fixes: f5223e9eee ("can: extend sockaddr_can to include j1939 members")
Reported-by: Richard Weinberger <richard@nod.at>
Tested-by: Richard Weinberger <richard@nod.at>
Acked-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Link: https://lore.kernel.org/linux-can/1135648123.112255.1616613706554.JavaMail.zimbra@nod.at/T/#t
Link: https://lore.kernel.org/r/20210325125850.1620-1-socketcan@hartkopp.net
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-03-29 09:51:20 +02:00
Oliver Hartkopp 0de70e287b can: raw: return -ERANGE when filterset does not fit into user space buffer
Multiple filters (struct can_filter) can be set with the setsockopt()
function, which was originally intended as a write-only operation.

As getsockopt() also provides a CAN_RAW_FILTER option to read back the
given filters, the caller has to provide an appropriate user space buffer.
In the case this buffer is too small the getsockopt() silently truncates
the filter information and gives no information about the needed space.
This is safe but not convenient for the programmer.

In net/core/sock.c the SO_PEERGROUPS sockopt had a similar requirement
and solved it by returning -ERANGE in the case that the provided data
does not fit into the given user space buffer and fills the required size
into optlen, so that the caller can retry with a matching buffer length.

This patch adopts this approach for CAN_RAW_FILTER getsockopt().

Reported-by: Phillip Schichtel <phillip@schich.tel>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Tested-By: Phillip Schichtel <phillip@schich.tel>
Link: https://lore.kernel.org/r/20201216174928.21663-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-01-06 15:15:41 +01:00
Oliver Hartkopp f726f3d371 can: remove obsolete version strings
As pointed out by Jakub Kicinski here:
http://lore.kernel.org/r/20201009175751.5c54097f@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com
this patch removes the obsolete version information of the different
CAN protocols and the AF_CAN core module.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20201012074354.25839-2-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2020-10-12 10:06:39 +02:00
Vincent Mailhol eb88531bdb can: raw: add missing error queue support
Error queue are not yet implemented in CAN-raw sockets.

The problem: a userland call to recvmsg(soc, msg, MSG_ERRQUEUE) on a
CAN-raw socket would unqueue messages from the normal queue without
any kind of error or warning. As such, it prevented CAN drivers from
using the functionalities that relies on the error queue such as
skb_tx_timestamp().

SCM_CAN_RAW_ERRQUEUE is defined as the type for the CAN raw error
queue. SCM stands for "Socket control messages". The name is inspired
from SCM_J1939_ERRQUEUE of include/uapi/linux/can/j1939.h.

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://lore.kernel.org/r/20200926162527.270030-1-mailhol.vincent@wanadoo.fr
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2020-10-06 22:44:27 +02:00
Masahiro Yamada d77cd7fefc can: remove "WITH Linux-syscall-note" from SPDX tag of C files
The "WITH Linux-syscall-note" exception is intended for UAPI headers.

See LICENSES/exceptions/Linux-syscall-note

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Link: https://lore.kernel.org/r/20200403073741.18352-1-masahiroy@kernel.org
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2020-09-21 10:13:16 +02:00
Marc Kleine-Budde 6a54dde843 can: raw: fix indention
This patch fixes the indention to follow kernel coding style.

Link: https://lore.kernel.org/r/20200915223527.1417033-7-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2020-09-21 10:13:16 +02:00
Christoph Hellwig a7b75c5a8c net: pass a sockptr_t into ->setsockopt
Rework the remaining setsockopt code to pass a sockptr_t instead of a
plain user pointer.  This removes the last remaining set_fs(KERNEL_DS)
outside of architecture specific code.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Stefan Schmidt <stefan@datenfreihafen.org> [ieee802154]
Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-07-24 15:41:54 -07:00
Kurt Van Dijck 9868b5d44f can: introduce CAN_REQUIRED_SIZE macro
The size of this structure will be increased with J1939 support. To stay
binary compatible, the CAN_REQUIRED_SIZE macro is introduced for
existing CAN protocols.

Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-09-04 13:29:15 +02:00
Marc Kleine-Budde af0b1470bd can: raw: raw_sock_no_ioctlcmd(): mark function as static
This patch marks the raw_sock_no_ioctlcmd() function as static as it's
only used in this source file.

Fixes: 473d924d7d ("can: fix ioctl function removal")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-08-13 17:32:20 +02:00
Marc Kleine-Budde d956b1a87f can: raw: raw_module_init(): use pr_err() instead of printk(KERN_ERR, ...)
This patch converts a printk(KERN_ERR, ...) to a pr_err().

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-08-13 17:32:20 +02:00
Marc Kleine-Budde bff1004067 can: raw: balance braces around else statements
This patch balances the braces around else statements, so that
checkpatch doesn't complain anymore.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-08-13 17:32:20 +02:00
Marc Kleine-Budde d5e4ecac87 can: raw: remove unnecessary blank lines, add suggested blank lines
This patch removes unnecessary blank lines, and adds suggested ones, so
that checkpatch doesn't complain anymore.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-08-13 17:32:20 +02:00
Marc Kleine-Budde d6ada83bba can: raw: convert block comments to network style comments
This patch converts all block comments to network subsystem style block
comments.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-08-13 17:32:20 +02:00
Oliver Hartkopp 473d924d7d can: fix ioctl function removal
Commit 60649d4e0a ("can: remove obsolete empty ioctl() handler") replaced the
almost empty can_ioctl() function with sock_no_ioctl() which always returns
-EOPNOTSUPP.

Even though we don't have any ioctl() functions on socket/network layer we need
to return -ENOIOCTLCMD to be able to forward ioctl commands like SIOCGIFINDEX
to the network driver layer.

This patch fixes the wrong return codes in the CAN network layer protocols.

Reported-by: kernel test robot <rong.a.chen@intel.com>
Fixes: 60649d4e0a ("can: remove obsolete empty ioctl() handler")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-07-29 14:12:35 -07:00
Oliver Hartkopp fba76a5845 can: Add SPDX license identifiers for CAN subsystem
Add missing SPDX identifiers for the CAN network layer and correct the SPDX
license for two of its include files to make sure the BSD-3-Clause applies
for the entire subsystem.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-07-24 10:31:55 +02:00
Oliver Hartkopp 60649d4e0a can: remove obsolete empty ioctl() handler
With commit c7cbdbf29f ("net: rework SIOCGSTAMP ioctl handling") the only
ioctl function in can_ioctl() has been removed.

As this SIOCGSTAMP ioctl command is now handled in net/socket.c we can entirely
remove the CAN specific ioctl functions.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2019-07-24 10:31:55 +02:00
Arnd Bergmann c7cbdbf29f net: rework SIOCGSTAMP ioctl handling
The SIOCGSTAMP/SIOCGSTAMPNS ioctl commands are implemented by many
socket protocol handlers, and all of those end up calling the same
sock_get_timestamp()/sock_get_timestampns() helper functions, which
results in a lot of duplicate code.

With the introduction of 64-bit time_t on 32-bit architectures, this
gets worse, as we then need four different ioctl commands in each
socket protocol implementation.

To simplify that, let's add a new .gettstamp() operation in
struct proto_ops, and move ioctl implementation into the common
sock_ioctl()/compat_sock_ioctl_trans() functions that these all go
through.

We can reuse the sock_get_timestamp() implementation, but generalize
it so it can deal with both native and compat mode, as well as
timeval and timespec structures.

Acked-by: Stefan Schmidt <stefan@datenfreihafen.org>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://lore.kernel.org/lkml/CAK8P3a038aDQQotzua_QtKGhq8O9n+rdiz2=WDCp82ys8eUT+A@mail.gmail.com/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-19 14:07:40 -07:00
Willem de Bruijn 8f932f762e net: add missing SOF_TIMESTAMPING_OPT_ID support
SOF_TIMESTAMPING_OPT_ID is supported on TCP, UDP and RAW sockets.
But it was missing on RAW with IPPROTO_IP, PF_PACKET and CAN.

Add skb_setup_tx_timestamp that configures both tx_flags and tskey
for these paths that do not need corking or use bytestream keys.

Fixes: 09c2d251b7 ("net-timestamp: add key to disambiguate concurrent datagrams")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-12-17 23:27:00 -08:00
Oliver Hartkopp a43608fa77 can: raw: check for CAN FD capable netdev in raw_sendmsg()
When the socket is CAN FD enabled it can handle CAN FD frame
transmissions.  Add an additional check in raw_sendmsg() as a CAN2.0 CAN
driver (non CAN FD) should never see a CAN FD frame. Due to the commonly
used can_dropped_invalid_skb() function the CAN 2.0 driver would drop
that CAN FD frame anyway - but with this patch the user gets a proper
-EINVAL return code.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2018-11-09 17:19:34 +01:00
Linus Torvalds a11e1d432b Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
The poll() changes were not well thought out, and completely
unexplained.  They also caused a huge performance regression, because
"->poll()" was no longer a trivial file operation that just called down
to the underlying file operations, but instead did at least two indirect
calls.

Indirect calls are sadly slow now with the Spectre mitigation, but the
performance problem could at least be largely mitigated by changing the
"->get_poll_head()" operation to just have a per-file-descriptor pointer
to the poll head instead.  That gets rid of one of the new indirections.

But that doesn't fix the new complexity that is completely unwarranted
for the regular case.  The (undocumented) reason for the poll() changes
was some alleged AIO poll race fixing, but we don't make the common case
slower and more complex for some uncommon special case, so this all
really needs way more explanations and most likely a fundamental
redesign.

[ This revert is a revert of about 30 different commits, not reverted
  individually because that would just be unnecessarily messy  - Linus ]

Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-06-28 10:40:47 -07:00
Christoph Hellwig db5051ead6 net: convert datagram_poll users tp ->poll_mask
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-26 09:16:44 +02:00
Denys Vlasenko 9b2c45d479 net: make getname() functions return length rather than use int* parameter
Changes since v1:
Added changes in these files:
    drivers/infiniband/hw/usnic/usnic_transport.c
    drivers/staging/lustre/lnet/lnet/lib-socket.c
    drivers/target/iscsi/iscsi_target_login.c
    drivers/vhost/net.c
    fs/dlm/lowcomms.c
    fs/ocfs2/cluster/tcp.c
    security/tomoyo/network.c

Before:
All these functions either return a negative error indicator,
or store length of sockaddr into "int *socklen" parameter
and return zero on success.

"int *socklen" parameter is awkward. For example, if caller does not
care, it still needs to provide on-stack storage for the value
it does not need.

None of the many FOO_getname() functions of various protocols
ever used old value of *socklen. They always just overwrite it.

This change drops this parameter, and makes all these functions, on success,
return length of sockaddr. It's always >= 0 and can be differentiated
from an error.

Tests in callers are changed from "if (err)" to "if (err < 0)", where needed.

rpc_sockname() lost "int buflen" parameter, since its only use was
to be passed to kernel_getsockname() as &buflen and subsequently
not used in any way.

Userspace API is not changed.

    text    data     bss      dec     hex filename
30108430 2633624  873672 33615726 200ef6e vmlinux.before.o
30108109 2633612  873672 33615393 200ee21 vmlinux.o

Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
CC: David S. Miller <davem@davemloft.net>
CC: linux-kernel@vger.kernel.org
CC: netdev@vger.kernel.org
CC: linux-bluetooth@vger.kernel.org
CC: linux-decnet-user@lists.sourceforge.net
CC: linux-wireless@vger.kernel.org
CC: linux-rdma@vger.kernel.org
CC: linux-sctp@vger.kernel.org
CC: linux-nfs@vger.kernel.org
CC: linux-x25@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-12 14:15:04 -05:00
Marc Kleine-Budde adb552c319 can: raw: raw_bind(): bail out if can_family is not AF_CAN
Until now CAN raw's bind() doesn't check if the can_familiy in the
struct sockaddr_can is set to AF_CAN. This patch adds the missing check.

Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2018-01-05 11:12:08 +01:00
Mario Kicherer 8e8cda6d73 can: initial support for network namespaces
This patch adds initial support for network namespaces. The changes only
enable support in the CAN raw, proc and af_can code. GW and BCM still
have their checks that ensure that they are used only from the main
namespace.

The patch boils down to moving the global structures, i.e. the global
filter list and their /proc stats, into a per-namespace structure and passing
around the corresponding "struct net" in a lot of different places.

Changes since v1:
 - rebased on current HEAD (2bfe01e)
 - fixed overlong line

Signed-off-by: Mario Kicherer <dev@kicherer.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2017-04-04 17:35:58 +02:00
Eric Dumazet f1712c7371 can: Fix kernel panic at security_sock_rcv_skb
Zhang Yanmin reported crashes [1] and provided a patch adding a
synchronize_rcu() call in can_rx_unregister()

The main problem seems that the sockets themselves are not RCU
protected.

If CAN uses RCU for delivery, then sockets should be freed only after
one RCU grace period.

Recent kernels could use sock_set_flag(sk, SOCK_RCU_FREE), but let's
ease stable backports with the following fix instead.

[1]
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff81495e25>] selinux_socket_sock_rcv_skb+0x65/0x2a0

Call Trace:
 <IRQ>
 [<ffffffff81485d8c>] security_sock_rcv_skb+0x4c/0x60
 [<ffffffff81d55771>] sk_filter+0x41/0x210
 [<ffffffff81d12913>] sock_queue_rcv_skb+0x53/0x3a0
 [<ffffffff81f0a2b3>] raw_rcv+0x2a3/0x3c0
 [<ffffffff81f06eab>] can_rcv_filter+0x12b/0x370
 [<ffffffff81f07af9>] can_receive+0xd9/0x120
 [<ffffffff81f07beb>] can_rcv+0xab/0x100
 [<ffffffff81d362ac>] __netif_receive_skb_core+0xd8c/0x11f0
 [<ffffffff81d36734>] __netif_receive_skb+0x24/0xb0
 [<ffffffff81d37f67>] process_backlog+0x127/0x280
 [<ffffffff81d36f7b>] net_rx_action+0x33b/0x4f0
 [<ffffffff810c88d4>] __do_softirq+0x184/0x440
 [<ffffffff81f9e86c>] do_softirq_own_stack+0x1c/0x30
 <EOI>
 [<ffffffff810c76fb>] do_softirq.part.18+0x3b/0x40
 [<ffffffff810c8bed>] do_softirq+0x1d/0x20
 [<ffffffff81d30085>] netif_rx_ni+0xe5/0x110
 [<ffffffff8199cc87>] slcan_receive_buf+0x507/0x520
 [<ffffffff8167ef7c>] flush_to_ldisc+0x21c/0x230
 [<ffffffff810e3baf>] process_one_work+0x24f/0x670
 [<ffffffff810e44ed>] worker_thread+0x9d/0x6f0
 [<ffffffff810e4450>] ? rescuer_thread+0x480/0x480
 [<ffffffff810ebafc>] kthread+0x12c/0x150
 [<ffffffff81f9ccef>] ret_from_fork+0x3f/0x70

Reported-by: Zhang Yanmin <yanmin.zhang@intel.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-29 18:30:56 -05:00
Marc Kleine-Budde 332b05ca7a can: raw: raw_setsockopt: limit number of can_filter that can be set
This patch adds a check to limit the number of can_filters that can be
set via setsockopt on CAN_RAW sockets. Otherwise allocations > MAX_ORDER
are not prevented resulting in a warning.

Reference: https://lkml.org/lkml/2016/12/2/230

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2016-12-07 10:45:57 +01:00
Soheil Hassas Yeganeh c14ac9451c sock: enable timestamping using control messages
Currently, SOL_TIMESTAMPING can only be enabled using setsockopt.
This is very costly when users want to sample writes to gather
tx timestamps.

Add support for enabling SO_TIMESTAMPING via control messages by
using tsflags added in `struct sockcm_cookie` (added in the previous
patches in this series) to set the tx_flags of the last skb created in
a sendmsg. With this patch, the timestamp recording bits in tx_flags
of the skbuff is overridden if SO_TIMESTAMPING is passed in a cmsg.

Please note that this is only effective for overriding the recording
timestamps flags. Users should enable timestamp reporting (e.g.,
SOF_TIMESTAMPING_SOFTWARE | SOF_TIMESTAMPING_OPT_ID) using
socket options and then should ask for SOF_TIMESTAMPING_TX_*
using control messages per sendmsg to sample timestamps for each
write.

Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-04-04 15:50:30 -04:00
Oliver Hartkopp d3b58c47d3 can: replace timestamp as unique skb attribute
Commit 514ac99c64 "can: fix multiple delivery of a single CAN frame for
overlapping CAN filters" requires the skb->tstamp to be set to check for
identical CAN skbs.

Without timestamping to be required by user space applications this timestamp
was not generated which lead to commit 36c01245eb "can: fix loss of CAN frames
in raw_rcv" - which forces the timestamp to be set in all CAN related skbuffs
by introducing several __net_timestamp() calls.

This forces e.g. out of tree drivers which are not using alloc_can{,fd}_skb()
to add __net_timestamp() after skbuff creation to prevent the frame loss fixed
in mainline Linux.

This patch removes the timestamp dependency and uses an atomic counter to
create an unique identifier together with the skbuff pointer.

Btw: the new skbcnt element introduced in struct can_skb_priv has to be
initialized with zero in out-of-tree drivers which are not using
alloc_can{,fd}_skb() too.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2015-07-12 21:13:22 +02:00
Oliver Hartkopp a5581ef4c2 can: introduce new raw socket option to join the given CAN filters
The CAN_RAW socket can set multiple CAN identifier specific filters that lead
to multiple filters in the af_can.c filter processing. These filters are
indenpendent from each other which leads to logical OR'ed filters when applied.

This socket option joines the given CAN filters in the way that only CAN frames
are passed to user space that matched *all* given CAN filters. The semantic for
the applied filters is therefore changed to a logical AND.

This is useful especially when the filterset is a combination of filters where
the CAN_INV_FILTER flag is set in order to notch single CAN IDs or CAN ID
ranges from the incoming traffic.

As the raw_rcv() function is executed from NET_RX softirq the introduced
variables are implemented as per-CPU variables to avoid extensive locking at
CAN frame reception time.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2015-04-01 11:28:22 +02:00
Oliver Hartkopp 514ac99c64 can: fix multiple delivery of a single CAN frame for overlapping CAN filters
The CAN_RAW socket can set multiple CAN identifier specific filters that lead
to multiple filters in the af_can.c filter processing. These filters are
indenpendent from each other which leads to logical OR'ed filters when applied.

This patch makes sure that every CAN frame which is filtered for a specific
socket is only delivered once to the user space. This is independent from the
number of matching CAN filters of this socket.

As the raw_rcv() function is executed from NET_RX softirq the introduced
variables are implemented as per-CPU variables to avoid extensive locking at
CAN frame reception time.

Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2015-04-01 11:27:41 +02:00