xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

can: isotp: isotp_release(): omit unintended hrtimer restart on socket release

Browse Source 
commit 14a4696bc3118ba49da28f79280e1d55603aa737 upstream.

When closing the isotp socket, the potentially running hrtimers are
canceled before removing the subscription for CAN identifiers via
can_rx_unregister().

This may lead to an unintended (re)start of a hrtimer in
isotp_rcv_cf() and isotp_rcv_fc() in the case that a CAN frame is
received by isotp_rcv() while the subscription removal is processed.

However, isotp_rcv() is called under RCU protection, so after calling
can_rx_unregister, we may call synchronize_rcu in order to wait for
any RCU read-side critical sections to finish. This prevents the
reception of CAN frames after hrtimer_cancel() and therefore the
unintended (re)start of the hrtimers.

Link: https://lore.kernel.org/r/20210618173713.2296-1-socketcan@hartkopp.net
Fixes: e057dd3fc2 ("can: add ISO 15765-2:2016 transport protocol")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Oliver Hartkopp
2021-06-18 19:37:13 +02:00
committed by Greg Kroah-Hartman
parent af94ef8f0b
commit 22bfa94db2
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
net/can/isotp.c
View File

@@ -1023,9 +1023,6 @@ static int isotp_release(struct socket *sock)
lock_sock(sk); lock_sock(sk);
hrtimer_cancel(&so->txtimer);
hrtimer_cancel(&so->rxtimer);
/* remove current filters & unregister */ /* remove current filters & unregister */
if (so->bound) { if (so->bound) {
if (so->ifindex) { if (so->ifindex) {
@@ -1037,10 +1034,14 @@ static int isotp_release(struct socket *sock)
SINGLE_MASK(so->rxid), SINGLE_MASK(so->rxid),
isotp_rcv, sk); isotp_rcv, sk);
dev_put(dev); dev_put(dev);
synchronize_rcu();
} }
} }
} }
hrtimer_cancel(&so->txtimer);
hrtimer_cancel(&so->rxtimer);
so->ifindex = 0; so->ifindex = 0;
so->bound = 0; so->bound = 0;