From nobody Tue Feb 10 04:02:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83177C7EE2E for ; Fri, 26 May 2023 17:20:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237538AbjEZRUK (ORCPT ); Fri, 26 May 2023 13:20:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40244 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242852AbjEZRUE (ORCPT ); Fri, 26 May 2023 13:20:04 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E38F125; Fri, 26 May 2023 10:19:50 -0700 (PDT) Received: from fpc.intra.ispras.ru (unknown [10.10.165.11]) by mail.ispras.ru (Postfix) with ESMTPSA id 2AF5B40737DC; Fri, 26 May 2023 17:19:47 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 2AF5B40737DC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1685121587; bh=Cc+0l3WE7NSHNX8IIVLOGJ444B7c/feMyWd0rLDcJoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sbVNOgNvzcWPAtC2+Q327iOEkePkSJfoEmS2k204zuPCOOuDee/3FhflR9QyxrGSW VcO9RpfK7HsQL0Lr2j/v7fdAYybNF5XLWDME/Ilw7I3k7s7NMe1fW2JhfpbhZ9EP7Y 8yGlUMP6Ho2VP/OXRL9EiEms6QVoJBgarapisQKM= From: Fedor Pchelkin To: Oleksij Rempel Cc: Fedor Pchelkin , Marc Kleine-Budde , kernel@pengutronix.de, Robin van der Gracht , Oliver Hartkopp , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Kurt Van Dijck , linux-can@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org Subject: [PATCH 1/2] can: j1939: change j1939_netdev_lock type to mutex Date: Fri, 26 May 2023 20:19:09 +0300 Message-Id: <20230526171910.227615-2-pchelkin@ispras.ru> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230526171910.227615-1-pchelkin@ispras.ru> References: <20230526171910.227615-1-pchelkin@ispras.ru> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" It turns out access to j1939_can_rx_register() needs to be serialized, otherwise j1939_priv can be corrupted when parallel threads call j1939_netdev_start() and j1939_can_rx_register() fails. This issue is thoroughly covered in other commit which serializes access to j1939_can_rx_register(). Change j1939_netdev_lock type to mutex so that we do not need to remove GFP_KERNEL from can_rx_register(). j1939_netdev_lock seems to be used in normal contexts where mutex usage is not prohibited. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Suggested-by: Alexey Khoroshilov Signed-off-by: Fedor Pchelkin Acked-by: Oleksij Rempel Tested-by: Oleksij Rempel --- Note that it has been only tested via Syzkaller and not with real hardware. net/can/j1939/main.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c index 821d4ff303b3..6ed79afe19a5 100644 --- a/net/can/j1939/main.c +++ b/net/can/j1939/main.c @@ -126,7 +126,7 @@ static void j1939_can_recv(struct sk_buff *iskb, void *= data) #define J1939_CAN_ID CAN_EFF_FLAG #define J1939_CAN_MASK (CAN_EFF_FLAG | CAN_RTR_FLAG) =20 -static DEFINE_SPINLOCK(j1939_netdev_lock); +static DEFINE_MUTEX(j1939_netdev_lock); =20 static struct j1939_priv *j1939_priv_create(struct net_device *ndev) { @@ -220,7 +220,7 @@ static void __j1939_rx_release(struct kref *kref) j1939_can_rx_unregister(priv); j1939_ecu_unmap_all(priv); j1939_priv_set(priv->ndev, NULL); - spin_unlock(&j1939_netdev_lock); + mutex_unlock(&j1939_netdev_lock); } =20 /* get pointer to priv without increasing ref counter */ @@ -248,9 +248,9 @@ static struct j1939_priv *j1939_priv_get_by_ndev(struct= net_device *ndev) { struct j1939_priv *priv; =20 - spin_lock(&j1939_netdev_lock); + mutex_lock(&j1939_netdev_lock); priv =3D j1939_priv_get_by_ndev_locked(ndev); - spin_unlock(&j1939_netdev_lock); + mutex_unlock(&j1939_netdev_lock); =20 return priv; } @@ -260,14 +260,14 @@ struct j1939_priv *j1939_netdev_start(struct net_devi= ce *ndev) struct j1939_priv *priv, *priv_new; int ret; =20 - spin_lock(&j1939_netdev_lock); + mutex_lock(&j1939_netdev_lock); priv =3D j1939_priv_get_by_ndev_locked(ndev); if (priv) { kref_get(&priv->rx_kref); - spin_unlock(&j1939_netdev_lock); + mutex_unlock(&j1939_netdev_lock); return priv; } - spin_unlock(&j1939_netdev_lock); + mutex_unlock(&j1939_netdev_lock); =20 priv =3D j1939_priv_create(ndev); if (!priv) @@ -277,20 +277,20 @@ struct j1939_priv *j1939_netdev_start(struct net_devi= ce *ndev) spin_lock_init(&priv->j1939_socks_lock); INIT_LIST_HEAD(&priv->j1939_socks); =20 - spin_lock(&j1939_netdev_lock); + mutex_lock(&j1939_netdev_lock); priv_new =3D j1939_priv_get_by_ndev_locked(ndev); if (priv_new) { /* Someone was faster than us, use their priv and roll * back our's. */ kref_get(&priv_new->rx_kref); - spin_unlock(&j1939_netdev_lock); + mutex_unlock(&j1939_netdev_lock); dev_put(ndev); kfree(priv); return priv_new; } j1939_priv_set(ndev, priv); - spin_unlock(&j1939_netdev_lock); + mutex_unlock(&j1939_netdev_lock); =20 ret =3D j1939_can_rx_register(priv); if (ret < 0) @@ -308,7 +308,7 @@ struct j1939_priv *j1939_netdev_start(struct net_device= *ndev) =20 void j1939_netdev_stop(struct j1939_priv *priv) { - kref_put_lock(&priv->rx_kref, __j1939_rx_release, &j1939_netdev_lock); + kref_put_mutex(&priv->rx_kref, __j1939_rx_release, &j1939_netdev_lock); j1939_priv_put(priv); } =20 --=20 2.34.1