From: Marc Kleine-Budde <mkl@pengutronix.de> Date: 2021-07-24 17:20:10
Hello Jakub, hello David,
this is a pull request of 6 patches for net/master.
The first patch is by Joakim Zhang targets the imx8mp device tree. It
removes the imx6 fallback from the flexcan binding, as the imx6 is not
compatible with the imx8mp.
Ziyang Xuan contributes a patch to fix a use-after-free in the CAN
raw's raw_setsockopt().
The next two patches target the CAN J1939 protocol. The first one is
by Oleksij Rempel and clarifies the lifetime of session object in
j1939_session_deactivate(). Zhang Changzhong's patch fixes the timeout
value between consecutive TP.DT.
Stephane Grosjean contributes a patch for the peak_usb driver to fix
reading of the rxerr/txerr values.
The last patch is by me for the mcp251xfd driver. It stops the
timestamp worker in case of a fatal error in the IRQ handler.
regards,
Marc
---
The following changes since commit 5aa1959d18003472cc741dc490c3335c5bd804e2:
Merge branch 'ionic-fixes' (2021-07-23 21:57:52 +0100)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.14-20210724
for you to fetch changes up to ef68a717960658e6a1e5f08adb0574326e9a12c2:
can: mcp251xfd: mcp251xfd_irq(): stop timestamping worker in case error in IRQ (2021-07-24 19:02:32 +0200)
----------------------------------------------------------------
linux-can-fixes-for-5.14-20210724
----------------------------------------------------------------
Joakim Zhang (1):
arm64: dts: imx8mp: remove fallback compatible string for FlexCAN
Marc Kleine-Budde (1):
can: mcp251xfd: mcp251xfd_irq(): stop timestamping worker in case error in IRQ
Oleksij Rempel (1):
can: j1939: j1939_session_deactivate(): clarify lifetime of session object
Stephane Grosjean (1):
can: peak_usb: pcan_usb_handle_bus_evt(): fix reading rxerr/txerr values
Zhang Changzhong (1):
can: j1939: j1939_xtp_rx_dat_one(): fix rxtimer value between consecutive TP.DT to 750ms
Ziyang Xuan (1):
can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 ++--
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 1 +
drivers/net/can/usb/peak_usb/pcan_usb.c | 10 ++++++----
net/can/j1939/transport.c | 11 ++++++++---
net/can/raw.c | 20 ++++++++++++++++++--
5 files changed, 35 insertions(+), 11 deletions(-)
From: Marc Kleine-Budde <mkl@pengutronix.de> Date: 2021-07-24 17:20:11
From: Stephane Grosjean <redacted>
This patch fixes an incorrect way of reading error counters in messages
received for this purpose from the PCAN-USB interface. These messages
inform about the increase or decrease of the error counters, whose values
are placed in bytes 1 and 2 of the message data (not 0 and 1).
Fixes: ea8b33bde76c ("can: pcan_usb: add support of rxerr/txerr counters")
Link: https://lore.kernel.org/r/20210625130931.27438-4-s.grosjean@peak-system.com
Cc: linux-stable <redacted>
Signed-off-by: Stephane Grosjean <redacted>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/usb/peak_usb/pcan_usb.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
@@ -117,7 +117,8 @@#define PCAN_USB_BERR_MASK (PCAN_USB_ERR_RXERR | PCAN_USB_ERR_TXERR)/* identify bus event packets with rx/tx error counters */-#define PCAN_USB_ERR_CNT 0x80+#define PCAN_USB_ERR_CNT_DEC 0x00 /* counters are decreasing */+#define PCAN_USB_ERR_CNT_INC 0x80 /* counters are increasing *//* private to PCAN-USB adapter */structpcan_usb{
@@ -608,11 +609,12 @@ static int pcan_usb_handle_bus_evt(struct pcan_usb_msg_context *mc, u8 ir)/* acccording to the content of the packet */switch(ir){-casePCAN_USB_ERR_CNT:+casePCAN_USB_ERR_CNT_DEC:+casePCAN_USB_ERR_CNT_INC:/* save rx/tx error counters from in the device context */-pdev->bec.rxerr=mc->ptr[0];-pdev->bec.txerr=mc->ptr[1];+pdev->bec.rxerr=mc->ptr[1];+pdev->bec.txerr=mc->ptr[2];break;default:
@@ -546,10 +546,18 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,return-EFAULT;}+rtnl_lock();lock_sock(sk);-if(ro->bound&&ro->ifindex)+if(ro->bound&&ro->ifindex){dev=dev_get_by_index(sock_net(sk),ro->ifindex);+if(!dev){+if(count>1)+kfree(filter);+err=-ENODEV;+gotoout_fil;+}+}if(ro->bound){/* (try to) register the new filters */
@@ -588,6 +596,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,dev_put(dev);release_sock(sk);+rtnl_unlock();break;
@@ -600,10 +609,16 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,err_mask&=CAN_ERR_MASK;+rtnl_lock();lock_sock(sk);-if(ro->bound&&ro->ifindex)+if(ro->bound&&ro->ifindex){dev=dev_get_by_index(sock_net(sk),ro->ifindex);+if(!dev){+err=-ENODEV;+gotoout_err;+}+}/* remove current error mask */if(ro->bound){
@@ -627,6 +642,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,dev_put(dev);release_sock(sk);+rtnl_unlock();break;
From: Marc Kleine-Budde <mkl@pengutronix.de> Date: 2021-07-24 17:20:11
From: Oleksij Rempel <o.rempel@pengutronix.de>
The j1939_session_deactivate() is decrementing the session ref-count and
potentially can free() the session. This would cause use-after-free
situation.
However, the code calling j1939_session_deactivate() does always hold
another reference to the session, so that it would not be free()ed in
this code path.
This patch adds a comment to make this clear and a WARN_ON, to ensure
that future changes will not violate this requirement. Further this
patch avoids dereferencing the session pointer as a precaution to avoid
use-after-free if the session is actually free()ed.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de
Reported-by: Xiaochen Zou <redacted>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
net/can/j1939/transport.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
@@ -1075,11 +1075,16 @@ static bool j1939_session_deactivate_locked(struct j1939_session *session)staticboolj1939_session_deactivate(structj1939_session*session){+structj1939_priv*priv=session->priv;boolactive;-j1939_session_list_lock(session->priv);+j1939_session_list_lock(priv);+/* This function should be called with a session ref-count of at+*least2.+*/+WARN_ON_ONCE(kref_read(&session->kref)<2);active=j1939_session_deactivate_locked(session);-j1939_session_list_unlock(session->priv);+j1939_session_list_unlock(priv);returnactive;}
From: Marc Kleine-Budde <mkl@pengutronix.de> Date: 2021-07-24 17:20:13
From: Joakim Zhang <redacted>
FlexCAN on i.MX8MP is not derived from i.MX6Q, instead reuses from
i.MX8QM with extra ECC added and default is enabled, so that the FlexCAN
would be put into freeze mode without FLEXCAN_QUIRK_DISABLE_MECR quirk.
This patch removes "fsl,imx6q-flexcan" fallback compatible string since
it's not compatible with the i.MX6Q.
Link: https://lore.kernel.org/r/20210719073437.32078-1-qiangqing.zhang@nxp.com
Signed-off-by: Joakim Zhang <redacted>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Marc Kleine-Budde <mkl@pengutronix.de> Date: 2021-07-24 17:20:13
In case an error occurred in the IRQ handler, the chip status is
dumped via devcoredump and all IRQs are disabled, but the chip stays
powered for further analysis.
The chip is in an undefined state and will not receive any CAN frames,
so shut down the timestamping worker, which reads the TBC register
regularly, too. This avoids any CRC read error messages if there is a
communication problem with the chip.
Fixes: efd8d98dfb90 ("can: mcp251xfd: add HW timestamp infrastructure")
Link: https://lore.kernel.org/r/20210724155131.471303-1-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 1 +
1 file changed, 1 insertion(+)
Hello:
This pull request was applied to netdev/net.git (refs/heads/master):
On Sat, 24 Jul 2021 19:19:41 +0200 you wrote:
Hello Jakub, hello David,
this is a pull request of 6 patches for net/master.
The first patch is by Joakim Zhang targets the imx8mp device tree. It
removes the imx6 fallback from the flexcan binding, as the imx6 is not
compatible with the imx8mp.
[...]