[PATCH net v8 0/4] can: j1939: fix the abort timer and bound EDPO

[PATCH net v8 0/4] can: j1939: fix the abort timer and bound EDPO

[Chaosheng Qu]

v8 addresses the three findings from the sashiko review of v7.

1/4 is rewritten.  The v7 version cancelled the receive timer before
taking active_session_list_lock and started it again under the lock, so
two concurrent callers could both reach hrtimer_start(): the second one
reprograms an already armed timer and the reference taken for the first
arm is never dropped, leaking the session and its netdev reference.  The
new j1939_tp_arm_rxtimer_locked() uses hrtimer_try_to_cancel(), which
never waits for a running callback, so the cancel and the start happen
together under the lock.  j1939_tp_set_rxtimeout() and the rx timeout
branch of j1939_tp_rxtimer() use the same helper, so there is one arming
path instead of three.

2/4 now calls j1939_session_timers_cancel() before aborting on an
out-of-range EDPO, as the other receive-path abort handlers do.
j1939_session_cancel() only rearms the abort timer, so the transmit timer
stayed armed on an aborting session: on the transmitter path the retries
kept firing until J1939_XTP_TX_RETRY_LIMIT and overwrote session->err with
-ENETUNREACH, on the receiver path they sent CTS or EOMA and clobbered the
abort timeout.  It also carries the Fixes tag for the NULL dereference.

3/4 and 4/4 are unchanged from v7.


Chaosheng Qu (4):
  can: j1939: serialize cancel and rearm of the receive timer
  can: j1939: validate the EDPO packet number
  can: j1939: drop the message when the reassembled skb is gone
  can: j1939: reject a CTS that names more packets than the message has

 net/can/j1939/transport.c | 119 +++++++++++++++++++++++++++++++-------
 1 file changed, 97 insertions(+), 22 deletions(-)

-- 
2.43.0