linux/net/can
Oliver Hartkopp 051737439e can: isotp: fix race between isotp_sendsmg() and isotp_release()
As discussed with Dae R. Jeong and Hillf Danton here [1] the sendmsg()
function in isotp.c might get into a race condition when restoring the
former tx.state from the old_state.

Remove the old_state concept and implement proper locking for the
ISOTP_IDLE transitions in isotp_sendmsg(), inspired by a
simplification idea from Hillf Danton.

Introduce a new tx.state ISOTP_SHUTDOWN and use the same locking
mechanism from isotp_release() which resolves a potential race between
isotp_sendsmg() and isotp_release().

[1] https://lore.kernel.org/linux-can/ZB%2F93xJxq%2FBUqAgG@dragonet

v1: https://lore.kernel.org/all/20230331102114.15164-1-socketcan@hartkopp.net
v2: https://lore.kernel.org/all/20230331123600.3550-1-socketcan@hartkopp.net
    take care of signal interrupts for wait_event_interruptible() in
    isotp_release()
v3: https://lore.kernel.org/all/20230331130654.9886-1-socketcan@hartkopp.net
    take care of signal interrupts for wait_event_interruptible() in
    isotp_sendmsg() in the wait_tx_done case
v4: https://lore.kernel.org/all/20230331131935.21465-1-socketcan@hartkopp.net
    take care of signal interrupts for wait_event_interruptible() in
    isotp_sendmsg() in ALL cases

Cc: Dae R. Jeong <threeearcat@gmail.com>
Cc: Hillf Danton <hdanton@sina.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Fixes: 4f027cba82 ("can: isotp: split tx timer into transmission and timeout")
Link: https://lore.kernel.org/all/20230331131935.21465-1-socketcan@hartkopp.net
Cc: stable@vger.kernel.org
[mkl: rephrase commit message]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2023-04-05 11:16:37 +02:00
..
j1939 can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access 2023-04-05 10:51:57 +02:00
af_can.c net: af_can: remove useless parameter 'err' in 'can_rx_register()' 2022-12-12 11:41:24 +01:00
af_can.h can: introduce CAN midlayer private and allocate it automatically 2019-09-04 13:29:14 +02:00
bcm.c can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write 2023-03-27 14:40:45 +02:00
gw.c can: gw: give feedback on missing CGW_FLAGS_CAN_IIF_TX_OK flag 2023-02-02 15:42:10 +01:00
isotp.c can: isotp: fix race between isotp_sendsmg() and isotp_release() 2023-04-05 11:16:37 +02:00
Kconfig net: Kconfig: move the CAN device menu to the "Device Drivers" section 2022-06-11 17:11:02 +02:00
Makefile can: add ISO 15765-2:2016 transport protocol 2020-10-07 23:18:33 +02:00
proc.c proc: remove PDE_DATA() completely 2022-01-22 08:33:37 +02:00
raw.c can: raw: use temp variable instead of rolling back config 2023-02-08 21:53:24 +01:00