Commit 7fcbe5b2 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Marc Kleine-Budde
Browse files

can: j1939: implement NETDEV_UNREGISTER notification handler 



syzbot is reporting

  unregister_netdevice: waiting for vcan0 to become free. Usage count = 2

problem, for j1939 protocol did not have NETDEV_UNREGISTER notification
handler for undoing changes made by j1939_sk_bind().

Commit 25fe97cb ("can: j1939: move j1939_priv_put() into sk_destruct
callback") expects that a call to j1939_priv_put() can be unconditionally
delayed until j1939_sk_sock_destruct() is called. But we need to call
j1939_priv_put() against an extra ref held by j1939_sk_bind() call
(as a part of undoing changes made by j1939_sk_bind()) as soon as
NETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct()
is called via j1939_sk_release()). Otherwise, the extra ref on "struct
j1939_priv" held by j1939_sk_bind() call prevents "struct net_device" from
dropping the usage count to 1; making it impossible for
unregister_netdevice() to continue.

Reported-by: default avatarsyzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84


Tested-by: default avatarsyzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
Fixes: 25fe97cb ("can: j1939: move j1939_priv_put() into sk_destruct callback")
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Acked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/ac9db9a4-6c30-416e-8b94-96e6559d55b2@I-love.SAKURA.ne.jp


[mkl: remove space in front of label]
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent d013ebc3

net/can/j1939/j1939-priv.h

+1 −0
Original line number Diff line number Diff line
@@ -212,6 +212,7 @@ void j1939_priv_get(struct j1939_priv *priv); 


/* notify/alert all j1939 sockets bound to ifindex */

void j1939_sk_netdev_event_netdown(struct j1939_priv *priv);

void j1939_sk_netdev_event_unregister(struct j1939_priv *priv);

int j1939_cancel_active_session(struct j1939_priv *priv, struct sock *sk);

void j1939_tp_init(struct j1939_priv *priv);

net/can/j1939/main.c

+3 −0
Original line number Diff line number Diff line
@@ -377,6 +377,9 @@ static int j1939_netdev_notify(struct notifier_block *nb, 
		j1939_sk_netdev_event_netdown(priv);

		j1939_ecu_unmap_all(priv);

		break;

	case NETDEV_UNREGISTER:

		j1939_sk_netdev_event_unregister(priv);

		break;

	}



	j1939_priv_put(priv);

net/can/j1939/socket.c

+49 −0
Original line number Diff line number Diff line
@@ -1300,6 +1300,55 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) 
	read_unlock_bh(&priv->j1939_socks_lock);

}



void j1939_sk_netdev_event_unregister(struct j1939_priv *priv)

{

	struct sock *sk;

	struct j1939_sock *jsk;

	bool wait_rcu = false;



rescan: /* The caller is holding a ref on this "priv" via j1939_priv_get_by_ndev(). */

	read_lock_bh(&priv->j1939_socks_lock);

	list_for_each_entry(jsk, &priv->j1939_socks, list) {

		/* Skip if j1939_jsk_add() is not called on this socket. */

		if (!(jsk->state & J1939_SOCK_BOUND))

			continue;

		sk = &jsk->sk;

		sock_hold(sk);

		read_unlock_bh(&priv->j1939_socks_lock);

		/* Check if j1939_jsk_del() is not yet called on this socket after holding

		 * socket's lock, for both j1939_sk_bind() and j1939_sk_release() call

		 * j1939_jsk_del() with socket's lock held.

		 */

		lock_sock(sk);

		if (jsk->state & J1939_SOCK_BOUND) {

			/* Neither j1939_sk_bind() nor j1939_sk_release() called j1939_jsk_del().

			 * Make this socket no longer bound, by pretending as if j1939_sk_bind()

			 * dropped old references but did not get new references.

			 */

			j1939_jsk_del(priv, jsk);

			j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa);

			j1939_netdev_stop(priv);

			/* Call j1939_priv_put() now and prevent j1939_sk_sock_destruct() from

			 * calling the corresponding j1939_priv_put().

			 *

			 * j1939_sk_sock_destruct() is supposed to call j1939_priv_put() after

			 * an RCU grace period. But since the caller is holding a ref on this

			 * "priv", we can defer synchronize_rcu() until immediately before

			 * the caller calls j1939_priv_put().

			 */

			j1939_priv_put(priv);

			jsk->priv = NULL;

			wait_rcu = true;

		}

		release_sock(sk);

		sock_put(sk);

		goto rescan;

	}

	read_unlock_bh(&priv->j1939_socks_lock);

	if (wait_rcu)

		synchronize_rcu();

}



static int j1939_sk_no_ioctlcmd(struct socket *sock, unsigned int cmd,

				unsigned long arg)

{