Commit 364642ae authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'linux-can-fixes-for-5.13-20210512' of... 

Merge tag 'linux-can-fixes-for-5.13-20210512' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can



Marc Kleine-Budde says:

====================
pull-request: can 2021-05-12

this is a pull request of a single patch for net/master.

The patch is by Norbert Slusarek and it fixes a race condition in the
CAN ISO-TP socket between isotp_bind() and isotp_setsockopt().
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 9c1bb37f 2b17c400

net/can/isotp.c

+33 −16
Original line number Diff line number Diff line
@@ -1062,26 +1062,30 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) 
	if (len < ISOTP_MIN_NAMELEN)

		return -EINVAL;



	if (addr->can_addr.tp.tx_id & (CAN_ERR_FLAG | CAN_RTR_FLAG))

		return -EADDRNOTAVAIL;



	if (!addr->can_ifindex)

		return -ENODEV;



	lock_sock(sk);



	/* do not register frame reception for functional addressing */

	if (so->opt.flags & CAN_ISOTP_SF_BROADCAST)

		do_rx_reg = 0;



	/* do not validate rx address for functional addressing */

	if (do_rx_reg) {

		if (addr->can_addr.tp.rx_id == addr->can_addr.tp.tx_id)

			return -EADDRNOTAVAIL;



		if (addr->can_addr.tp.rx_id & (CAN_ERR_FLAG | CAN_RTR_FLAG))

			return -EADDRNOTAVAIL;

		if (addr->can_addr.tp.rx_id == addr->can_addr.tp.tx_id) {

			err = -EADDRNOTAVAIL;

			goto out;

		}



	if (addr->can_addr.tp.tx_id & (CAN_ERR_FLAG | CAN_RTR_FLAG))

		return -EADDRNOTAVAIL;



	if (!addr->can_ifindex)

		return -ENODEV;



	lock_sock(sk);

		if (addr->can_addr.tp.rx_id & (CAN_ERR_FLAG | CAN_RTR_FLAG)) {

			err = -EADDRNOTAVAIL;

			goto out;

		}

	}



	if (so->bound && addr->can_ifindex == so->ifindex &&

	    addr->can_addr.tp.rx_id == so->rxid &&
@@ -1164,16 +1168,13 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer) 
	return ISOTP_MIN_NAMELEN;

}



static int isotp_setsockopt(struct socket *sock, int level, int optname,

static int isotp_setsockopt_locked(struct socket *sock, int level, int optname,

			    sockptr_t optval, unsigned int optlen)

{

	struct sock *sk = sock->sk;

	struct isotp_sock *so = isotp_sk(sk);

	int ret = 0;



	if (level != SOL_CAN_ISOTP)

		return -EINVAL;



	if (so->bound)

		return -EISCONN;
@@ -1248,6 +1249,22 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname, 
	return ret;

}



static int isotp_setsockopt(struct socket *sock, int level, int optname,

			    sockptr_t optval, unsigned int optlen)



{

	struct sock *sk = sock->sk;

	int ret;



	if (level != SOL_CAN_ISOTP)

		return -EINVAL;



	lock_sock(sk);

	ret = isotp_setsockopt_locked(sock, level, optname, optval, optlen);

	release_sock(sk);

	return ret;

}



static int isotp_getsockopt(struct socket *sock, int level, int optname,

			    char __user *optval, int __user *optlen)

{