linux-kernel - Re: [PATCH v6] can, tty: can327 CAN/ldisc driver for ELM327 based OBD-II adapters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 May 2022 01:24:00 +0900
From:   Vincent Mailhol <vincent.mailhol@...il.com>
To:     Max Staudt <max@...as.org>
Cc:     Wolfgang Grandegger <wg@...ndegger.com>,
        Marc Kleine-Budde <mkl@...gutronix.de>,
        linux-can@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Oliver Neukum <oneukum@...e.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v6] can, tty: can327 CAN/ldisc driver for ELM327 based
 OBD-II adapters

Forgot one comment.

On Fri 13 May 2022 at 03:29, Max Staudt <max@...as.org> wrote:
[...]
> +/* Send a can_frame to a TTY. */
> +static netdev_tx_t can327_netdev_start_xmit(struct sk_buff *skb,
> +                                           struct net_device *dev)
> +{
> +       struct can327 *elm = netdev_priv(dev);
> +       struct can_frame *frame = (struct can_frame *)skb->data;
> +
> +       if (can_dropped_invalid_skb(dev, skb))
> +               return NETDEV_TX_OK;
> +
> +       /* BHs are already disabled, so no spin_lock_bh().
> +        * See Documentation/networking/netdevices.txt
> +        */
> +       spin_lock(&elm->lock);
> +
> +       /* We shouldn't get here after a hardware fault:
> +        * can_bus_off() calls netif_carrier_off()
> +        */
> +       WARN_ON_ONCE(elm->uart_side_failure);
> +
> +       if (!elm->tty ||
> +           elm->uart_side_failure ||
> +           elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
> +               spin_unlock(&elm->lock);
> +               goto out;
> +       }
> +
> +       netif_stop_queue(dev);
> +
> +       elm327_send_frame(elm, frame);
> +       spin_unlock(&elm->lock);
> +
> +       dev->stats.tx_packets++;
> +       dev->stats.tx_bytes += frame->len;

Do not increase tx_bytes for RTR frame. c.f.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc4b08c31b5c51352f258032cc65e884b3e61e6a

Also, when is the frame freed? Did you double check there is no race
condition resulting in a use after free on frame->len? Similar to:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=03f16c5075b22c8902d2af739969e878b0879c94

> +       can_led_event(dev, CAN_LED_EVENT_TX);

Please adjust according to Oliver's patch.

> +out:
> +       kfree_skb(skb);
> +       return NETDEV_TX_OK;
> +}
> +
> +static const struct net_device_ops can327_netdev_ops = {
> +       .ndo_open       = can327_netdev_open,
> +       .ndo_stop       = can327_netdev_close,
> +       .ndo_start_xmit = can327_netdev_start_xmit,
> +       .ndo_change_mtu = can_change_mtu,
> +};
[...]

Yours sincerely,
Vincent Mailhol