Commit 46cea215 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Marc Kleine-Budde
Browse files

can: j1939: make j1939_sk_bind() fail if device is no longer registered 



There is a theoretical race window in j1939_sk_netdev_event_unregister()
where two j1939_sk_bind() calls jump in between read_unlock_bh() and
lock_sock().

The assumption jsk->priv == priv can fail if the first j1939_sk_bind()
call once made jsk->priv == NULL due to failed j1939_local_ecu_get() call
and the second j1939_sk_bind() call again made jsk->priv != NULL due to
successful j1939_local_ecu_get() call.

Since the socket lock is held by both j1939_sk_netdev_event_unregister()
and j1939_sk_bind(), checking ndev->reg_state with the socket lock held can
reliably make the second j1939_sk_bind() call fail (and close this race
window).

Fixes: 7fcbe5b2 ("can: j1939: implement NETDEV_UNREGISTER notification handler")
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/5732921e-247e-4957-a364-da74bd7031d7@I-love.SAKURA.ne.jp


Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 5d560223

net/can/j1939/socket.c

+6 −0
Original line number Diff line number Diff line
@@ -482,6 +482,12 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr_unsized *uaddr, in 
			goto out_release_sock;

		}



		if (ndev->reg_state != NETREG_REGISTERED) {

			dev_put(ndev);

			ret = -ENODEV;

			goto out_release_sock;

		}



		can_ml = can_get_ml_priv(ndev);

		if (!can_ml) {

			dev_put(ndev);