git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From d3e2904f71ea0fe7eaff1d68a2b0363c888ea0fb Mon Sep 17 00:00:00 2001
   2 From: Oleksij Rempel <o.rempel@pengutronix.de>
   3 Date: Fri, 17 Nov 2023 13:49:59 +0100
   4 Subject: net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
   5
   6 From: Oleksij Rempel <o.rempel@pengutronix.de>
   7
   8 commit d3e2904f71ea0fe7eaff1d68a2b0363c888ea0fb upstream.
   9
  10 This patch enhances error handling in scenarios with RTS (Request to
  11 Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE
  12 backtraces with a new error handling method. This provides clearer error
  13 messages and allows for the early termination of problematic sessions.
  14 Previously, sessions were only released at the end of j1939_xtp_rx_rts().
  15
  16 Potentially this could be reproduced with something like:
  17 testj1939 -r vcan0:0x80 &
  18 while true; do
  19         # send first RTS
  20         cansend vcan0 18EC8090#1014000303002301;
  21         # send second RTS
  22         cansend vcan0 18EC8090#1014000303002301;
  23         # send abort
  24         cansend vcan0 18EC8090#ff00000000002301;
  25 done
  26
  27 Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
  28 Reported-by: syzbot+daa36413a5cedf799ae4@syzkaller.appspotmail.com
  29 Cc: stable@vger.kernel.org
  30 Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
  31 Link: https://lore.kernel.org/all/20231117124959.961171-1-o.rempel@pengutronix.de
  32 Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
  33 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  34 ---
  35  net/can/j1939/transport.c |   19 +++++++++++++++++--
  36  1 file changed, 17 insertions(+), 2 deletions(-)
  37
  38 --- a/net/can/j1939/transport.c
  39 +++ b/net/can/j1939/transport.c
  40 @@ -1593,8 +1593,8 @@ j1939_session *j1939_xtp_rx_rts_session_
  41         struct j1939_sk_buff_cb skcb = *j1939_skb_to_cb(skb);
  42         struct j1939_session *session;
  43         const u8 *dat;
  44 +       int len, ret;
  45         pgn_t pgn;
  46 -       int len;
  47
  48         netdev_dbg(priv->ndev, "%s\n", __func__);
  49
  50 @@ -1653,7 +1653,22 @@ j1939_session *j1939_xtp_rx_rts_session_
  51         session->tskey = priv->rx_tskey++;
  52         j1939_sk_errqueue(session, J1939_ERRQUEUE_RX_RTS);
  53
  54 -       WARN_ON_ONCE(j1939_session_activate(session));
  55 +       ret = j1939_session_activate(session);
  56 +       if (ret) {
  57 +               /* Entering this scope indicates an issue with the J1939 bus.
  58 +                * Possible scenarios include:
  59 +                * - A time lapse occurred, and a new session was initiated
  60 +                *   due to another packet being sent correctly. This could
  61 +                *   have been caused by too long interrupt, debugger, or being
  62 +                *   out-scheduled by another task.
  63 +                * - The bus is receiving numerous erroneous packets, either
  64 +                *   from a malfunctioning device or during a test scenario.
  65 +                */
  66 +               netdev_alert(priv->ndev, "%s: 0x%p: concurrent session with same addr (%02x %02x) is already active.\n",
  67 +                            __func__, session, skcb.addr.sa, skcb.addr.da);
  68 +               j1939_session_put(session);
  69 +               return NULL;
  70 +       }
  71
  72         return session;
  73  }