* [PATCH 1/4] can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it
[not found] <20190122132116.7074-1-mkl@pengutronix.de>
@ 2019-01-22 13:21 ` Marc Kleine-Budde
2019-01-22 13:21 ` [PATCH 2/4] can: bcm: check timer values before ktime conversion Marc Kleine-Budde
2019-01-22 13:21 ` [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup Marc Kleine-Budde
2 siblings, 0 replies; 7+ messages in thread
From: Marc Kleine-Budde @ 2019-01-22 13:21 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Manfred Schlaegl, linux-stable,
Marc Kleine-Budde
From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
This patch revert commit 7da11ba5c506
("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb")
After introduction of this change we encountered following new error
message on various i.MX plattforms (flexcan):
| flexcan 53fc8000.can can0: __can_get_echo_skb: BUG! Trying to echo non
| existing skb: can_priv::echo_skb[0]
The introduction of the message was a mistake because
priv->echo_skb[idx] = NULL is a perfectly valid in following case: If
CAN_RAW_LOOPBACK is disabled (setsockopt) in applications, the pkt_type
of the tx skb's given to can_put_echo_skb is set to PACKET_LOOPBACK. In
this case can_put_echo_skb will not set priv->echo_skb[idx]. It is
therefore kept NULL.
As additional argument for revert: The order of check and usage of idx
was changed. idx is used to access an array element before checking it's
boundaries.
Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
Fixes: 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/dev.c | 27 +++++++++++++--------------
1 file changed, 13 insertions(+), 14 deletions(-)
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 3b3f88ffab53..c05e4d50d43d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -480,8 +480,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
{
struct can_priv *priv = netdev_priv(dev);
- struct sk_buff *skb = priv->echo_skb[idx];
- struct canfd_frame *cf;
if (idx >= priv->echo_skb_max) {
netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
@@ -489,20 +487,21 @@ struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8
return NULL;
}
- if (!skb) {
- netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
- __func__, idx);
- return NULL;
- }
+ if (priv->echo_skb[idx]) {
+ /* Using "struct canfd_frame::len" for the frame
+ * length is supported on both CAN and CANFD frames.
+ */
+ struct sk_buff *skb = priv->echo_skb[idx];
+ struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+ u8 len = cf->len;
- /* Using "struct canfd_frame::len" for the frame
- * length is supported on both CAN and CANFD frames.
- */
- cf = (struct canfd_frame *)skb->data;
- *len_ptr = cf->len;
- priv->echo_skb[idx] = NULL;
+ *len_ptr = len;
+ priv->echo_skb[idx] = NULL;
- return skb;
+ return skb;
+ }
+
+ return NULL;
}
/*
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 2/4] can: bcm: check timer values before ktime conversion
[not found] <20190122132116.7074-1-mkl@pengutronix.de>
2019-01-22 13:21 ` [PATCH 1/4] can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it Marc Kleine-Budde
@ 2019-01-22 13:21 ` Marc Kleine-Budde
[not found] ` <20190123225748.AF445218A1@mail.kernel.org>
2019-01-22 13:21 ` [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup Marc Kleine-Budde
2 siblings, 1 reply; 7+ messages in thread
From: Marc Kleine-Budde @ 2019-01-22 13:21 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Oliver Hartkopp, Kyungtae Kim,
linux-stable, Andre Naujoks, Marc Kleine-Budde
From: Oliver Hartkopp <socketcan@hartkopp.net>
Kyungtae Kim detected a potential integer overflow in bcm_[rx|tx]_setup()
when the conversion into ktime multiplies the given value with NSEC_PER_USEC
(1000).
Reference: https://marc.info/?l=linux-can&m=154732118819828&w=2
Add a check for the given tv_usec, so that the value stays below one second.
Additionally limit the tv_sec value to a reasonable value for CAN related
use-cases of 400 days and ensure all values to be positive.
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: linux-stable <stable@vger.kernel.org> # >= 2.6.26
Tested-by: Kyungtae Kim <kt0755@gmail.com>
Acked-by: Andre Naujoks <nautsch2@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
net/can/bcm.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 0af8f0db892a..79bb8afa9c0c 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -67,6 +67,9 @@
*/
#define MAX_NFRAMES 256
+/* limit timers to 400 days for sending/timeouts */
+#define BCM_TIMER_SEC_MAX (400 * 24 * 60 * 60)
+
/* use of last_frames[index].flags */
#define RX_RECV 0x40 /* received data for this element */
#define RX_THR 0x80 /* element not been sent due to throttle feature */
@@ -140,6 +143,22 @@ static inline ktime_t bcm_timeval_to_ktime(struct bcm_timeval tv)
return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
}
+/* check limitations for timeval provided by user */
+static bool bcm_is_invalid_tv(struct bcm_msg_head *msg_head)
+{
+ if ((msg_head->ival1.tv_sec < 0) ||
+ (msg_head->ival1.tv_sec > BCM_TIMER_SEC_MAX) ||
+ (msg_head->ival1.tv_usec < 0) ||
+ (msg_head->ival1.tv_usec >= USEC_PER_SEC) ||
+ (msg_head->ival2.tv_sec < 0) ||
+ (msg_head->ival2.tv_sec > BCM_TIMER_SEC_MAX) ||
+ (msg_head->ival2.tv_usec < 0) ||
+ (msg_head->ival2.tv_usec >= USEC_PER_SEC))
+ return true;
+
+ return false;
+}
+
#define CFSIZ(flags) ((flags & CAN_FD_FRAME) ? CANFD_MTU : CAN_MTU)
#define OPSIZ sizeof(struct bcm_op)
#define MHSIZ sizeof(struct bcm_msg_head)
@@ -873,6 +892,10 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
if (msg_head->nframes < 1 || msg_head->nframes > MAX_NFRAMES)
return -EINVAL;
+ /* check timeval limitations */
+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+ return -EINVAL;
+
/* check the given can_id */
op = bcm_find_op(&bo->tx_ops, msg_head, ifindex);
if (op) {
@@ -1053,6 +1076,10 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
(!(msg_head->can_id & CAN_RTR_FLAG))))
return -EINVAL;
+ /* check timeval limitations */
+ if ((msg_head->flags & SETTIMER) && bcm_is_invalid_tv(msg_head))
+ return -EINVAL;
+
/* check the given can_id */
op = bcm_find_op(&bo->rx_ops, msg_head, ifindex);
if (op) {
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup
[not found] <20190122132116.7074-1-mkl@pengutronix.de>
2019-01-22 13:21 ` [PATCH 1/4] can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it Marc Kleine-Budde
2019-01-22 13:21 ` [PATCH 2/4] can: bcm: check timer values before ktime conversion Marc Kleine-Budde
@ 2019-01-22 13:21 ` Marc Kleine-Budde
2019-01-22 13:35 ` Uwe Kleine-König
[not found] ` <20190123225745.3D239218A2@mail.kernel.org>
2 siblings, 2 replies; 7+ messages in thread
From: Marc Kleine-Budde @ 2019-01-22 13:21 UTC (permalink / raw)
To: netdev
Cc: davem, linux-can, kernel, Uwe Kleine-König, linux-stable,
Marc Kleine-Budde
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb)
and in the body accessed regs->mb[i] which is an out-of-bounds array
access that then resulted in an access to an reserved register area.
Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add
provision for variable payload size") to iterate a bit differently but
still runs one iteration too much resulting to call
flexcan_get_mb(priv, priv->mb_count)
which results in a WARN_ON and then a NULL pointer exception. This
only affects devices compatible with "fsl,p1010-flexcan",
"fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan",
"fsl,imx28-flexcan", so newer i.MX SoCs are not affected.
Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: linux-stable <stable@vger.kernel.org> # >= 4.20
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/flexcan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 5f097648d12d..1c66fb2ad76b 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1106,7 +1106,7 @@ static int flexcan_chip_start(struct net_device *dev)
}
} else {
/* clear and invalidate unused mailboxes first */
- for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= priv->mb_count; i++) {
+ for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i < priv->mb_count; i++) {
mb = flexcan_get_mb(priv, i);
priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
&mb->can_ctrl);
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup
2019-01-22 13:21 ` [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup Marc Kleine-Budde
@ 2019-01-22 13:35 ` Uwe Kleine-König
[not found] ` <20190123225745.3D239218A2@mail.kernel.org>
1 sibling, 0 replies; 7+ messages in thread
From: Uwe Kleine-König @ 2019-01-22 13:35 UTC (permalink / raw)
To: Marc Kleine-Budde; +Cc: netdev, davem, linux-can, kernel, linux-stable
On Tue, Jan 22, 2019 at 02:21:16PM +0100, Marc Kleine-Budde wrote:
> From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
>
> Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
> introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb)
> and in the body accessed regs->mb[i] which is an out-of-bounds array
> access that then resulted in an access to an reserved register area.
>
> Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add
> provision for variable payload size") to iterate a bit differently but
> still runs one iteration too much resulting to call
>
> flexcan_get_mb(priv, priv->mb_count)
>
> which results in a WARN_ON and then a NULL pointer exception. This
> only affects devices compatible with "fsl,p1010-flexcan",
> "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan",
> "fsl,imx28-flexcan", so newer i.MX SoCs are not affected.
>
> Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX")
> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> Cc: linux-stable <stable@vger.kernel.org> # >= 4.20
Given that cbffaf7aa09e was backported to v4.19.x a fix is needed there,
too. The patch looks different but I already sent a patch to
stable@vger.k.o.
Not sure if ">= 4.20" should be adapted accordingly. cbffaf7aa09e was
backported resulting in commit 24e5589791d0 which made it into v4.19.6.
Best regards
Uwe
--
Pengutronix e.K. | Uwe Kleine-König |
Industrial Linux Solutions | http://www.pengutronix.de/ |
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup
[not found] ` <20190123225745.3D239218A2@mail.kernel.org>
@ 2019-01-24 7:26 ` Uwe Kleine-König
2019-01-28 16:12 ` Greg KH
0 siblings, 1 reply; 7+ messages in thread
From: Uwe Kleine-König @ 2019-01-24 7:26 UTC (permalink / raw)
To: Sasha Levin; +Cc: Marc Kleine-Budde, netdev, davem, linux-can, stable
Hello Sasha,
On Wed, Jan 23, 2019 at 10:57:44PM +0000, Sasha Levin wrote:
> [This is an automated email]
Not sure if I only state the obvious that was just missed by your
automation.
>
> This commit has been processed because it contains a "Fixes:" tag,
> fixing commit: cbffaf7aa09e can: flexcan: Always use last mailbox for TX.
>
> The bot has tested the following trees: v4.20.3, v4.19.16.
>
> v4.20.3: Failed to apply! Possible dependencies:
> 0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
> 22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
> 5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
> 7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
> de3578c198c6 ("can: flexcan: add self wakeup support")
>
> v4.19.16: Failed to apply! Possible dependencies:
> 0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
> 22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
> 5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
> 7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
> de3578c198c6 ("can: flexcan: add self wakeup support")
>
>
> How should we proceed with this patch?
When I posted the commit I also posted one that fits on top of v4.19.x.
I would expect that the same also fits on v4.20.x. If not, tell me.
Best regards
Uwe
--
Pengutronix e.K. | Uwe Kleine-König |
Industrial Linux Solutions | http://www.pengutronix.de/ |
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 2/4] can: bcm: check timer values before ktime conversion
[not found] ` <20190123225748.AF445218A1@mail.kernel.org>
@ 2019-01-24 9:13 ` Oliver Hartkopp
0 siblings, 0 replies; 7+ messages in thread
From: Oliver Hartkopp @ 2019-01-24 9:13 UTC (permalink / raw)
To: Sasha Levin, Marc Kleine-Budde, netdev; +Cc: davem, linux-can, stable
Hi Shasha,
On 23.01.19 23:57, Sasha Levin wrote:
> Hi,
>
> [This is an automated email]
>
> This commit has been processed because it contains a -stable tag.
> The stable tag indicates that it's relevant for the following trees: 2.6.26+
>
> The bot has tested the following trees: v4.20.3, v4.19.16, v4.14.94, v4.9.151, v4.4.171, v3.18.132.
>
> v4.20.3: Build OK!
> v4.19.16: Build OK!
> v4.14.94: Build OK!
> v4.9.151: Build OK!
> v4.4.171: Failed to apply! Possible dependencies:
> 2b5f5f5dc114 ("can: bcm: unify bcm_msg_head handling and prepare function parameters")
> 6f3b911d5f29 ("can: bcm: add support for CAN FD frames")
> 72c8a89ad2e4 ("can: bcm: use CAN frame instead of can_frame in comments")
> 95acb490ec51 ("can: bcm: fix indention and other minor style issues")
>
> v3.18.132: Failed to apply! Possible dependencies:
> 069f8457ae52 ("can: fix spelling errors")
> 2b5f5f5dc114 ("can: bcm: unify bcm_msg_head handling and prepare function parameters")
> 6ce8e9ce5989 ("new helper: memcpy_from_msg()")
> 6f3b911d5f29 ("can: bcm: add support for CAN FD frames")
> 72c8a89ad2e4 ("can: bcm: use CAN frame instead of can_frame in comments")
> 95acb490ec51 ("can: bcm: fix indention and other minor style issues")
> ba61a8d9d780 ("can: avoid using timeval for uapi")
>
>
> How should we proceed with this patch?
As we do have a proper upstream commit hash now ...
https://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git/commit/?h=testing&id=93171ba6f1deffd82f381d36cb13177872d023f6
... here is the ported patch for kernels pre version 4.8:
https://marc.info/?l=linux-can&m=154832094402622&w=2
Thanks,
Oliver
ps. the pull request to Dave is still hanging here:
https://marc.info/?l=linux-can&m=154831478900596&w=2
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup
2019-01-24 7:26 ` Uwe Kleine-König
@ 2019-01-28 16:12 ` Greg KH
0 siblings, 0 replies; 7+ messages in thread
From: Greg KH @ 2019-01-28 16:12 UTC (permalink / raw)
To: Uwe Kleine-König
Cc: Sasha Levin, Marc Kleine-Budde, netdev, davem, linux-can, stable
On Thu, Jan 24, 2019 at 08:26:10AM +0100, Uwe Kleine-König wrote:
> Hello Sasha,
>
> On Wed, Jan 23, 2019 at 10:57:44PM +0000, Sasha Levin wrote:
> > [This is an automated email]
>
> Not sure if I only state the obvious that was just missed by your
> automation.
> >
> > This commit has been processed because it contains a "Fixes:" tag,
> > fixing commit: cbffaf7aa09e can: flexcan: Always use last mailbox for TX.
> >
> > The bot has tested the following trees: v4.20.3, v4.19.16.
> >
> > v4.20.3: Failed to apply! Possible dependencies:
> > 0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
> > 22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
> > 5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
> > 7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
> > de3578c198c6 ("can: flexcan: add self wakeup support")
> >
> > v4.19.16: Failed to apply! Possible dependencies:
> > 0517961ccdf1 ("can: flexcan: Add provision for variable payload size")
> > 22233f7bf2c9 ("can: flexcan: FLEXCAN_IFLAG_MB: add () around macro argument")
> > 5156c7b11f35 ("can: flexcan: move rx_offload_add() from flexcan_probe() to flexcan_open()")
> > 7ad0f53a394b ("can: flexcan: flexcan_chip_start(): enable loopback mode in flexcan")
> > de3578c198c6 ("can: flexcan: add self wakeup support")
> >
> >
> > How should we proceed with this patch?
>
> When I posted the commit I also posted one that fits on top of v4.19.x.
> I would expect that the same also fits on v4.20.x. If not, tell me.
Ah, I see that now, sorry for the noise of the FAILED email...
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-01-28 17:08 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20190122132116.7074-1-mkl@pengutronix.de>
2019-01-22 13:21 ` [PATCH 1/4] can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it Marc Kleine-Budde
2019-01-22 13:21 ` [PATCH 2/4] can: bcm: check timer values before ktime conversion Marc Kleine-Budde
[not found] ` <20190123225748.AF445218A1@mail.kernel.org>
2019-01-24 9:13 ` Oliver Hartkopp
2019-01-22 13:21 ` [PATCH 4/4] can: flexcan: fix NULL pointer exception during bringup Marc Kleine-Budde
2019-01-22 13:35 ` Uwe Kleine-König
[not found] ` <20190123225745.3D239218A2@mail.kernel.org>
2019-01-24 7:26 ` Uwe Kleine-König
2019-01-28 16:12 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).