mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

can: bcm: track a single source interface for ANYDEV timeout/throttle ops

Browse Source 
An ANYDEV rx op (ifindex == 0) with an active RX timeout and/or
throttle timer has no defined semantics when matching frames arrive
from several interfaces: bcm_rx_handler() can run concurrently for
the same op on different CPUs, racing hrtimer_cancel()/
bcm_rx_starttimer() against bcm_rx_timeout_handler() and causing
spurious RX_TIMEOUT notifications and last_frames corruption. The
same concurrency lets throttled multiplex frames from different
interfaces clobber the single rx_ifindex/rx_stamp fields shared by
the op.

Add op->if_detected to track the first interface that delivers a
matching frame while a timeout/throttle timer is configured, and
reject frames from any other interface for that op. The claim is
decided in bcm_rx_handler() before hrtimer_cancel() touches
op->timer, so a rejected frame can never disturb the claimed
interface's watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,
independent of kt_ival1/kt_ival2, since those may briefly hold a
stale value from an earlier non-RTR configuration.

The claim is released in bcm_notify() on NETDEV_UNREGISTER and in
bcm_rx_setup() when SETTIMER reconfigures the timer values.

A (re-)claim is only possible on CAN devices in NETREG_REGISTERED
dev->reg_state to cover the release in bcm_notify() where reg_state
becomes NETREG_UNREGISTERING until synchronize_net().

Fixes: ffd980f976 ("[CAN]: Add broadcast manager (bcm) protocol")
Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/linux-can/20260709105031.1A39C1F000E9@smtp.kernel.org/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-11-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This commit is contained in:
Oliver Hartkopp
2026-07-14 18:55:33 +02:00
committed by Marc Kleine-Budde
parent 58fd6cbc85
commit 2f5976f54a
1 changed files with 44 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
net/can/bcm.c
View File

@@ -117,6 +117,7 @@ struct bcm_op {
struct hrtimer timer, thrtimer;
ktime_t rx_stamp, kt_ival1, kt_ival2, kt_lastmsg;
int rx_ifindex;
int if_detected; /* first received ifindex in ANYDEV rx_op mode */
int cfsiz;
u32 count;
u32 nframes;
@@ -797,6 +798,33 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
return;
}
/* An ANYDEV op with an active RX timeout and/or throttle timer
* tracks a single source interface: claim the first interface that
* delivers a matching frame and reject frames from any other one,
* before hrtimer_cancel() below can touch op->timer - this avoids
* racing bcm_rx_timeout_handler() across concurrent interfaces.
* RX_RTR_FRAME ops are excluded, as kt_ival1/kt_ival2 may briefly
* hold a stale value from an earlier non-RTR configuration.
*/
if (!op->ifindex) {
spin_lock_bh(&op->bcm_rx_update_lock);
if (!(op->flags & RX_RTR_FRAME) &&
(op->kt_ival1 || op->kt_ival2)) {
/* don't claim to vanishing interface */
if (!op->if_detected &&
READ_ONCE(skb->dev->reg_state) == NETREG_REGISTERED)
op->if_detected = skb->dev->ifindex;
if (op->if_detected != skb->dev->ifindex) {
spin_unlock_bh(&op->bcm_rx_update_lock);
return;
}
}
spin_unlock_bh(&op->bcm_rx_update_lock);
}
/* disable timeout */
hrtimer_cancel(&op->timer);
@@ -831,10 +859,9 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
traffic_flags |= RX_OWN;
}
/* save rx timestamp and originator for recvfrom() under lock.
* For an op subscribed on all interfaces (ifindex == 0)
* bcm_rx_handler() can run concurrently on different CPUs so
* the CAN content and the meta data must be bundled correctly.
/* save rx timestamp and originator for recvfrom() under lock: an
* ANYDEV op without an active timer can still run concurrently on
* different CPUs, so content and meta data must be bundled here.
*/
op->rx_stamp = skb->tstamp;
op->rx_ifindex = skb->dev->ifindex;
@@ -1369,6 +1396,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
op->kt_ival1 = bcm_timeval_to_ktime(msg_head->ival1);
op->kt_ival2 = bcm_timeval_to_ktime(msg_head->ival2);
op->kt_lastmsg = 0;
op->if_detected = 0; /* reclaim ifindex in ANYDEV mode */
}
spin_unlock_bh(&op->bcm_rx_update_lock);
@@ -1775,10 +1803,21 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,
lock_sock(sk);
/* rx_ops: remove device specific receive entries */
list_for_each_entry(op, &bo->rx_ops, list)
list_for_each_entry(op, &bo->rx_ops, list) {
if (op->rx_reg_dev == dev)
bcm_rx_unreg(dev, op);
/* release an ANYDEV op's claim (see bcm_rx_handler())
* on this now confirmed-gone interface.
*/
if (!op->ifindex) {
spin_lock_bh(&op->bcm_rx_update_lock);
if (op->if_detected == dev->ifindex)
op->if_detected = 0;
spin_unlock_bh(&op->bcm_rx_update_lock);
}
}
/* tx_ops: stop device specific cyclic transmissions on the
* vanishing ifindex. Cancelling the timer is enough to stop
* cyclic bcm_can_tx() calls as there is no re-arming.