releases/4.14.97/can-dev-__can_get_echo_skb-fix-bogous-check-for-non-existing-skb-by-removing-it.patch

   1 From 7b12c8189a3dc50638e7d53714c88007268d47ef Mon Sep 17 00:00:00 2001
   2 From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
   3 Date: Wed, 19 Dec 2018 19:39:58 +0100
   4 Subject: can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it
   5
   6 From: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
   7
   8 commit 7b12c8189a3dc50638e7d53714c88007268d47ef upstream.
   9
  10 This patch revert commit 7da11ba5c506
  11 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb")
  12
  13 After introduction of this change we encountered following new error
  14 message on various i.MX plattforms (flexcan):
  15
  16 | flexcan 53fc8000.can can0: __can_get_echo_skb: BUG! Trying to echo non
  17 | existing skb: can_priv::echo_skb[0]
  18
  19 The introduction of the message was a mistake because
  20 priv->echo_skb[idx] = NULL is a perfectly valid in following case: If
  21 CAN_RAW_LOOPBACK is disabled (setsockopt) in applications, the pkt_type
  22 of the tx skb's given to can_put_echo_skb is set to PACKET_LOOPBACK. In
  23 this case can_put_echo_skb will not set priv->echo_skb[idx]. It is
  24 therefore kept NULL.
  25
  26 As additional argument for revert: The order of check and usage of idx
  27 was changed. idx is used to access an array element before checking it's
  28 boundaries.
  29
  30 Signed-off-by: Manfred Schlaegl <manfred.schlaegl@ginzinger.com>
  31 Fixes: 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb")
  32 Cc: linux-stable <stable@vger.kernel.org>
  33 Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
  34 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  35
  36 ---
  37  drivers/net/can/dev.c |   27 +++++++++++++--------------
  38  1 file changed, 13 insertions(+), 14 deletions(-)
  39
  40 --- a/drivers/net/can/dev.c
  41 +++ b/drivers/net/can/dev.c
  42 @@ -479,8 +479,6 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
  43  struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
  44  {
  45         struct can_priv *priv = netdev_priv(dev);
  46 -       struct sk_buff *skb = priv->echo_skb[idx];
  47 -       struct canfd_frame *cf;
  48
  49         if (idx >= priv->echo_skb_max) {
  50                 netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
  51 @@ -488,20 +486,21 @@ struct sk_buff *__can_get_echo_skb(struc
  52                 return NULL;
  53         }
  54
  55 -       if (!skb) {
  56 -               netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
  57 -                          __func__, idx);
  58 -               return NULL;
  59 -       }
  60 +       if (priv->echo_skb[idx]) {
  61 +               /* Using "struct canfd_frame::len" for the frame
  62 +                * length is supported on both CAN and CANFD frames.
  63 +                */
  64 +               struct sk_buff *skb = priv->echo_skb[idx];
  65 +               struct canfd_frame *cf = (struct canfd_frame *)skb->data;
  66 +               u8 len = cf->len;
  67
  68 -       /* Using "struct canfd_frame::len" for the frame
  69 -        * length is supported on both CAN and CANFD frames.
  70 -        */
  71 -       cf = (struct canfd_frame *)skb->data;
  72 -       *len_ptr = cf->len;
  73 -       priv->echo_skb[idx] = NULL;
  74 +               *len_ptr = len;
  75 +               priv->echo_skb[idx] = NULL;
  76 +
  77 +               return skb;
  78 +       }
  79
  80 -       return skb;
  81 +       return NULL;
  82  }
  83
  84  /*