1 // SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) 2 /* isotp.c - ISO 15765-2 CAN transport protocol for protocol family CAN 3 * 4 * This implementation does not provide ISO-TP specific return values to the 5 * userspace. 6 * 7 * - RX path timeout of data reception leads to -ETIMEDOUT 8 * - RX path SN mismatch leads to -EILSEQ 9 * - RX path data reception with wrong padding leads to -EBADMSG 10 * - TX path flowcontrol reception timeout leads to -ECOMM 11 * - TX path flowcontrol reception overflow leads to -EMSGSIZE 12 * - TX path flowcontrol reception with wrong layout/padding leads to -EBADMSG 13 * - when a transfer (tx) is on the run the next write() blocks until it's done 14 * - use CAN_ISOTP_WAIT_TX_DONE flag to block the caller until the PDU is sent 15 * - as we have static buffers the check whether the PDU fits into the buffer 16 * is done at FF reception time (no support for sending 'wait frames') 17 * 18 * Copyright (c) 2020 Volkswagen Group Electronic Research 19 * All rights reserved. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 3. Neither the name of Volkswagen nor the names of its contributors 30 * may be used to endorse or promote products derived from this software 31 * without specific prior written permission. 32 * 33 * Alternatively, provided that this notice is retained in full, this 34 * software may be distributed under the terms of the GNU General 35 * Public License ("GPL") version 2, in which case the provisions of the 36 * GPL apply INSTEAD OF those given above. 37 * 38 * The provided data structures and external interfaces from this code 39 * are not restricted to be used by modules with a GPL compatible license. 40 * 41 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 42 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 43 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 44 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 45 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 46 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 47 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 48 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 49 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 50 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 51 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 52 * DAMAGE. 53 */ 54 55 #include <linux/module.h> 56 #include <linux/init.h> 57 #include <linux/interrupt.h> 58 #include <linux/spinlock.h> 59 #include <linux/hrtimer.h> 60 #include <linux/wait.h> 61 #include <linux/uio.h> 62 #include <linux/net.h> 63 #include <linux/netdevice.h> 64 #include <linux/socket.h> 65 #include <linux/if_arp.h> 66 #include <linux/skbuff.h> 67 #include <linux/can.h> 68 #include <linux/can/core.h> 69 #include <linux/can/skb.h> 70 #include <linux/can/isotp.h> 71 #include <linux/slab.h> 72 #include <net/can.h> 73 #include <net/sock.h> 74 #include <net/net_namespace.h> 75 76 MODULE_DESCRIPTION("PF_CAN ISO 15765-2 transport protocol"); 77 MODULE_LICENSE("Dual BSD/GPL"); 78 MODULE_AUTHOR("Oliver Hartkopp <socketcan@hartkopp.net>"); 79 MODULE_ALIAS("can-proto-6"); 80 81 #define ISOTP_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp) 82 83 #define SINGLE_MASK(id) (((id) & CAN_EFF_FLAG) ? \ 84 (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \ 85 (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG)) 86 87 /* Since ISO 15765-2:2016 the CAN isotp protocol supports more than 4095 88 * byte per ISO PDU as the FF_DL can take full 32 bit values (4 Gbyte). 89 * We would need some good concept to handle this between user space and 90 * kernel space. For now set the static buffer to something about 8 kbyte 91 * to be able to test this new functionality. 92 */ 93 #define DEFAULT_MAX_PDU_SIZE 8300 94 95 /* maximum PDU size before ISO 15765-2:2016 extension was 4095 */ 96 #define MAX_12BIT_PDU_SIZE 4095 97 98 /* limit the isotp pdu size from the optional module parameter to 1MByte */ 99 #define MAX_PDU_SIZE (1025 * 1024U) 100 101 static unsigned int max_pdu_size __read_mostly = DEFAULT_MAX_PDU_SIZE; 102 module_param(max_pdu_size, uint, 0444); 103 MODULE_PARM_DESC(max_pdu_size, "maximum isotp pdu size (default " 104 __stringify(DEFAULT_MAX_PDU_SIZE) ")"); 105 106 /* N_PCI type values in bits 7-4 of N_PCI bytes */ 107 #define N_PCI_SF 0x00 /* single frame */ 108 #define N_PCI_FF 0x10 /* first frame */ 109 #define N_PCI_CF 0x20 /* consecutive frame */ 110 #define N_PCI_FC 0x30 /* flow control */ 111 112 #define N_PCI_SZ 1 /* size of the PCI byte #1 */ 113 #define SF_PCI_SZ4 1 /* size of SingleFrame PCI including 4 bit SF_DL */ 114 #define SF_PCI_SZ8 2 /* size of SingleFrame PCI including 8 bit SF_DL */ 115 #define FF_PCI_SZ12 2 /* size of FirstFrame PCI including 12 bit FF_DL */ 116 #define FF_PCI_SZ32 6 /* size of FirstFrame PCI including 32 bit FF_DL */ 117 #define FC_CONTENT_SZ 3 /* flow control content size in byte (FS/BS/STmin) */ 118 119 #define ISOTP_CHECK_PADDING (CAN_ISOTP_CHK_PAD_LEN | CAN_ISOTP_CHK_PAD_DATA) 120 #define ISOTP_ALL_BC_FLAGS (CAN_ISOTP_SF_BROADCAST | CAN_ISOTP_CF_BROADCAST) 121 122 /* Flow Status given in FC frame */ 123 #define ISOTP_FC_CTS 0 /* clear to send */ 124 #define ISOTP_FC_WT 1 /* wait */ 125 #define ISOTP_FC_OVFLW 2 /* overflow */ 126 127 #define ISOTP_FC_TIMEOUT 1 /* 1 sec */ 128 #define ISOTP_ECHO_TIMEOUT 2 /* 2 secs */ 129 130 /* so->tx_result[so->tx_gen % ISOTP_TX_RESULT_SLOTS] holds the packed value 131 * (err << ISOTP_TX_RESULT_GEN_BITS | gen) for each tx generation slot, so it 132 * can be handled with a single READ_ONCE()/WRITE_ONCE() access. 133 */ 134 #define ISOTP_TX_RESULT_SLOTS 4 135 #define ISOTP_TX_RESULT_GEN_BITS 24 136 #define ISOTP_TX_RESULT_GEN_MASK ((1U << ISOTP_TX_RESULT_GEN_BITS) - 1) 137 #define ISOTP_TX_RESULT_ERR_MASK 0xFF 138 139 enum { 140 ISOTP_IDLE = 0, 141 ISOTP_WAIT_FIRST_FC, 142 ISOTP_WAIT_FC, 143 ISOTP_WAIT_DATA, 144 ISOTP_SENDING, 145 ISOTP_SHUTDOWN, 146 }; 147 148 struct tpcon { 149 u8 *buf; 150 unsigned int buflen; 151 unsigned int len; 152 unsigned int idx; 153 u32 state; 154 u8 bs; 155 u8 sn; 156 u8 ll_dl; 157 u8 sbuf[DEFAULT_MAX_PDU_SIZE]; 158 }; 159 160 struct isotp_sock { 161 struct sock sk; 162 int bound; 163 int ifindex; 164 struct net_device *dev; 165 netdevice_tracker dev_tracker; 166 canid_t txid; 167 canid_t rxid; 168 ktime_t tx_gap; 169 ktime_t lastrxcf_tstamp; 170 struct hrtimer rxtimer, txtimer, txfrtimer, echotimer; 171 struct can_isotp_options opt; 172 struct can_isotp_fc_options rxfc, txfc; 173 struct can_isotp_ll_options ll; 174 u32 frame_txtime; 175 u32 force_tx_stmin; 176 u32 force_rx_stmin; 177 u32 cfecho; /* consecutive frame echo tag */ 178 u32 tx_gen; /* transfer generation, increased per new tx transfer */ 179 u32 tx_result[ISOTP_TX_RESULT_SLOTS]; /* per-generation result slots */ 180 struct tpcon rx, tx; 181 struct list_head notifier; 182 wait_queue_head_t wait; 183 spinlock_t rx_lock; /* protect single thread state machine */ 184 }; 185 186 static LIST_HEAD(isotp_notifier_list); 187 static DEFINE_SPINLOCK(isotp_notifier_lock); 188 static struct isotp_sock *isotp_busy_notifier; 189 190 /* increase (24 bit) tx generation value */ 191 static u32 isotp_inc_tx_gen(u32 gen) 192 { 193 return (gen + 1) & ISOTP_TX_RESULT_GEN_MASK; 194 } 195 196 /* store 8 bit error and 24 bit tx generation values in packed u32 element */ 197 static u32 isotp_pack_tx_result(u32 gen, int err) 198 { 199 return gen | ((u32)err << ISOTP_TX_RESULT_GEN_BITS); 200 } 201 202 /* get the 24 bit tx generation value from the tx result */ 203 static u32 isotp_get_tx_gen(u32 gen_err) 204 { 205 return gen_err & ISOTP_TX_RESULT_GEN_MASK; 206 } 207 208 /* get the 8 bit error value from the tx result */ 209 static u32 isotp_get_tx_err(u32 gen_err) 210 { 211 return (gen_err >> ISOTP_TX_RESULT_GEN_BITS) & ISOTP_TX_RESULT_ERR_MASK; 212 } 213 214 /* store transfer result in per-generation%4 so->tx_result[] slot */ 215 static void isotp_set_tx_result(struct isotp_sock *so, u32 gen, int err) 216 { 217 WRITE_ONCE(so->tx_result[gen % ISOTP_TX_RESULT_SLOTS], 218 isotp_pack_tx_result(gen, err)); 219 } 220 221 /* fetch the result recorded for 'gen', as a (negative) errno (0 for success) */ 222 static int isotp_get_tx_result(struct isotp_sock *so, u32 gen) 223 { 224 u32 result = READ_ONCE(so->tx_result[gen % ISOTP_TX_RESULT_SLOTS]); 225 226 if (isotp_get_tx_gen(result) != gen) { 227 pr_notice_once("can-isotp: tx_result[] slot reused before read\n"); 228 229 /* report failure rather than risk a false success */ 230 return -ECOMM; 231 } 232 233 return -(isotp_get_tx_err(result)); 234 } 235 236 /* true if done, shut down or superseded ('gen' is no longer the active 237 * transfer). Reads tx.state first (acquire) so tx_gen/tx_result reads 238 * below see at least what that state write published (common sequence). 239 */ 240 static bool isotp_tx_gen_done(struct isotp_sock *so, u32 gen) 241 { 242 /* read tx.state first for the common sequence */ 243 u32 state = smp_load_acquire(&so->tx.state); 244 245 return state == ISOTP_IDLE || state == ISOTP_SHUTDOWN || 246 READ_ONCE(so->tx_gen) != gen; 247 } 248 249 static inline struct isotp_sock *isotp_sk(const struct sock *sk) 250 { 251 return (struct isotp_sock *)sk; 252 } 253 254 static u32 isotp_bc_flags(struct isotp_sock *so) 255 { 256 return so->opt.flags & ISOTP_ALL_BC_FLAGS; 257 } 258 259 static bool isotp_register_rxid(struct isotp_sock *so) 260 { 261 /* no broadcast modes => register rx_id for FC frame reception */ 262 return (isotp_bc_flags(so) == 0); 263 } 264 265 static enum hrtimer_restart isotp_rx_timer_handler(struct hrtimer *hrtimer) 266 { 267 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 268 rxtimer); 269 struct sock *sk = &so->sk; 270 271 if (READ_ONCE(so->rx.state) == ISOTP_WAIT_DATA) { 272 /* we did not get new data frames in time */ 273 274 /* report 'connection timed out' */ 275 sk->sk_err = ETIMEDOUT; 276 if (!sock_flag(sk, SOCK_DEAD)) 277 sk_error_report(sk); 278 279 /* reset rx state */ 280 WRITE_ONCE(so->rx.state, ISOTP_IDLE); 281 } 282 283 return HRTIMER_NORESTART; 284 } 285 286 static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) 287 { 288 struct net_device *dev; 289 struct sk_buff *nskb; 290 struct can_skb_ext *csx; 291 struct canfd_frame *ncf; 292 struct isotp_sock *so = isotp_sk(sk); 293 int can_send_ret; 294 295 nskb = alloc_skb(so->ll.mtu, gfp_any()); 296 if (!nskb) 297 return 1; 298 299 csx = can_skb_ext_add(nskb); 300 if (!csx) { 301 kfree_skb(nskb); 302 return 1; 303 } 304 305 dev = dev_get_by_index(sock_net(sk), so->ifindex); 306 if (!dev) { 307 kfree_skb(nskb); 308 return 1; 309 } 310 311 csx->can_iif = dev->ifindex; 312 nskb->dev = dev; 313 can_skb_set_owner(nskb, sk); 314 ncf = (struct canfd_frame *)nskb->data; 315 skb_put_zero(nskb, so->ll.mtu); 316 317 /* create & send flow control reply */ 318 ncf->can_id = so->txid; 319 320 if (so->opt.flags & CAN_ISOTP_TX_PADDING) { 321 memset(ncf->data, so->opt.txpad_content, CAN_MAX_DLEN); 322 ncf->len = CAN_MAX_DLEN; 323 } else { 324 ncf->len = ae + FC_CONTENT_SZ; 325 } 326 327 ncf->data[ae] = N_PCI_FC | flowstatus; 328 ncf->data[ae + 1] = so->rxfc.bs; 329 ncf->data[ae + 2] = so->rxfc.stmin; 330 331 if (ae) 332 ncf->data[0] = so->opt.ext_address; 333 334 ncf->flags = so->ll.tx_flags; 335 336 can_send_ret = can_send(nskb, 1); 337 if (can_send_ret) 338 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 339 __func__, ERR_PTR(can_send_ret)); 340 341 dev_put(dev); 342 343 /* reset blocksize counter */ 344 so->rx.bs = 0; 345 346 /* reset last CF frame rx timestamp for rx stmin enforcement */ 347 so->lastrxcf_tstamp = ktime_set(0, 0); 348 349 /* start rx timeout watchdog */ 350 hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 351 HRTIMER_MODE_REL_SOFT); 352 return 0; 353 } 354 355 static void isotp_rcv_skb(struct sk_buff *skb, struct sock *sk) 356 { 357 struct sockaddr_can *addr = (struct sockaddr_can *)skb->cb; 358 enum skb_drop_reason reason; 359 360 BUILD_BUG_ON(sizeof(skb->cb) < sizeof(struct sockaddr_can)); 361 362 memset(addr, 0, sizeof(*addr)); 363 addr->can_family = AF_CAN; 364 addr->can_ifindex = skb->dev->ifindex; 365 366 reason = sock_queue_rcv_skb_reason(sk, skb); 367 if (reason) 368 sk_skb_reason_drop(sk, skb, reason); 369 } 370 371 static u8 padlen(u8 datalen) 372 { 373 static const u8 plen[] = { 374 8, 8, 8, 8, 8, 8, 8, 8, 8, /* 0 - 8 */ 375 12, 12, 12, 12, /* 9 - 12 */ 376 16, 16, 16, 16, /* 13 - 16 */ 377 20, 20, 20, 20, /* 17 - 20 */ 378 24, 24, 24, 24, /* 21 - 24 */ 379 32, 32, 32, 32, 32, 32, 32, 32, /* 25 - 32 */ 380 48, 48, 48, 48, 48, 48, 48, 48, /* 33 - 40 */ 381 48, 48, 48, 48, 48, 48, 48, 48 /* 41 - 48 */ 382 }; 383 384 if (datalen > 48) 385 return 64; 386 387 return plen[datalen]; 388 } 389 390 /* check for length optimization and return 1/true when the check fails */ 391 static int check_optimized(struct canfd_frame *cf, int start_index) 392 { 393 /* for CAN_DL <= 8 the start_index is equal to the CAN_DL as the 394 * padding would start at this point. E.g. if the padding would 395 * start at cf.data[7] cf->len has to be 7 to be optimal. 396 * Note: The data[] index starts with zero. 397 */ 398 if (cf->len <= CAN_MAX_DLEN) 399 return (cf->len != start_index); 400 401 /* This relation is also valid in the non-linear DLC range, where 402 * we need to take care of the minimal next possible CAN_DL. 403 * The correct check would be (padlen(cf->len) != padlen(start_index)). 404 * But as cf->len can only take discrete values from 12, .., 64 at this 405 * point the padlen(cf->len) is always equal to cf->len. 406 */ 407 return (cf->len != padlen(start_index)); 408 } 409 410 /* check padding and return 1/true when the check fails */ 411 static int check_pad(struct isotp_sock *so, struct canfd_frame *cf, 412 int start_index, u8 content) 413 { 414 int i; 415 416 /* no RX_PADDING value => check length of optimized frame length */ 417 if (!(so->opt.flags & CAN_ISOTP_RX_PADDING)) { 418 if (so->opt.flags & CAN_ISOTP_CHK_PAD_LEN) 419 return check_optimized(cf, start_index); 420 421 /* no valid test against empty value => ignore frame */ 422 return 1; 423 } 424 425 /* check datalength of correctly padded CAN frame */ 426 if ((so->opt.flags & CAN_ISOTP_CHK_PAD_LEN) && 427 cf->len != padlen(cf->len)) 428 return 1; 429 430 /* check padding content */ 431 if (so->opt.flags & CAN_ISOTP_CHK_PAD_DATA) { 432 for (i = start_index; i < cf->len; i++) 433 if (cf->data[i] != content) 434 return 1; 435 } 436 return 0; 437 } 438 439 static void isotp_send_cframe(struct isotp_sock *so); 440 441 static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) 442 { 443 struct sock *sk = &so->sk; 444 int tx_err = EBADMSG; /* default for unknown FC status */ 445 446 if (READ_ONCE(so->tx.state) != ISOTP_WAIT_FC && 447 READ_ONCE(so->tx.state) != ISOTP_WAIT_FIRST_FC) 448 return 0; 449 450 hrtimer_cancel(&so->txtimer); 451 452 /* isotp_tx_timeout() may have given up on this job while 453 * hrtimer_cancel() above waited for it to finish => recheck 454 */ 455 if (READ_ONCE(so->tx.state) != ISOTP_WAIT_FC && 456 READ_ONCE(so->tx.state) != ISOTP_WAIT_FIRST_FC) 457 return 1; 458 459 if ((cf->len < ae + FC_CONTENT_SZ) || 460 ((so->opt.flags & ISOTP_CHECK_PADDING) && 461 check_pad(so, cf, ae + FC_CONTENT_SZ, so->opt.rxpad_content))) { 462 /* malformed PDU - report 'not a data message' */ 463 sk->sk_err = EBADMSG; 464 if (!sock_flag(sk, SOCK_DEAD)) 465 sk_error_report(sk); 466 467 isotp_set_tx_result(so, so->tx_gen, EBADMSG); 468 /* set to IDLE after publishing tx_result */ 469 smp_store_release(&so->tx.state, ISOTP_IDLE); 470 wake_up_interruptible(&so->wait); 471 return 1; 472 } 473 474 /* get static/dynamic communication params from first/every FC frame */ 475 if (READ_ONCE(so->tx.state) == ISOTP_WAIT_FIRST_FC || 476 so->opt.flags & CAN_ISOTP_DYN_FC_PARMS) { 477 so->txfc.bs = cf->data[ae + 1]; 478 so->txfc.stmin = cf->data[ae + 2]; 479 480 /* fix wrong STmin values according spec */ 481 if (so->txfc.stmin > 0x7F && 482 (so->txfc.stmin < 0xF1 || so->txfc.stmin > 0xF9)) 483 so->txfc.stmin = 0x7F; 484 485 so->tx_gap = ktime_set(0, 0); 486 /* add transmission time for CAN frame N_As */ 487 so->tx_gap = ktime_add_ns(so->tx_gap, so->frame_txtime); 488 /* add waiting time for consecutive frames N_Cs */ 489 if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) 490 so->tx_gap = ktime_add_ns(so->tx_gap, 491 so->force_tx_stmin); 492 else if (so->txfc.stmin < 0x80) 493 so->tx_gap = ktime_add_ns(so->tx_gap, 494 so->txfc.stmin * 1000000); 495 else 496 so->tx_gap = ktime_add_ns(so->tx_gap, 497 (so->txfc.stmin - 0xF0) 498 * 100000); 499 WRITE_ONCE(so->tx.state, ISOTP_WAIT_FC); 500 } 501 502 switch (cf->data[ae] & 0x0F) { 503 case ISOTP_FC_CTS: 504 so->tx.bs = 0; 505 WRITE_ONCE(so->tx.state, ISOTP_SENDING); 506 /* send CF frame and enable echo timeout handling */ 507 hrtimer_start(&so->echotimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 508 HRTIMER_MODE_REL_SOFT); 509 isotp_send_cframe(so); 510 break; 511 512 case ISOTP_FC_WT: 513 /* start timer to wait for next FC frame */ 514 hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 515 HRTIMER_MODE_REL_SOFT); 516 break; 517 518 case ISOTP_FC_OVFLW: 519 /* overflow on receiver side - report 'message too long' */ 520 tx_err = EMSGSIZE; 521 fallthrough; 522 523 default: 524 /* reserved/unknown flow status (tx_err defaults to EBADMSG) */ 525 526 sk->sk_err = tx_err; 527 if (!sock_flag(sk, SOCK_DEAD)) 528 sk_error_report(sk); 529 530 isotp_set_tx_result(so, so->tx_gen, tx_err); 531 /* set to IDLE after publishing tx_result */ 532 smp_store_release(&so->tx.state, ISOTP_IDLE); 533 wake_up_interruptible(&so->wait); 534 } 535 return 0; 536 } 537 538 static int isotp_rcv_sf(struct sock *sk, struct canfd_frame *cf, int pcilen, 539 struct sk_buff *skb, int len) 540 { 541 struct isotp_sock *so = isotp_sk(sk); 542 struct sk_buff *nskb; 543 544 hrtimer_cancel(&so->rxtimer); 545 WRITE_ONCE(so->rx.state, ISOTP_IDLE); 546 547 if (!len || len > cf->len - pcilen) 548 return 1; 549 550 if ((so->opt.flags & ISOTP_CHECK_PADDING) && 551 check_pad(so, cf, pcilen + len, so->opt.rxpad_content)) { 552 /* malformed PDU - report 'not a data message' */ 553 sk->sk_err = EBADMSG; 554 if (!sock_flag(sk, SOCK_DEAD)) 555 sk_error_report(sk); 556 return 1; 557 } 558 559 nskb = alloc_skb(len, gfp_any()); 560 if (!nskb) 561 return 1; 562 563 memcpy(skb_put(nskb, len), &cf->data[pcilen], len); 564 565 nskb->tstamp = skb->tstamp; 566 nskb->dev = skb->dev; 567 isotp_rcv_skb(nskb, sk); 568 return 0; 569 } 570 571 static int isotp_rcv_ff(struct sock *sk, struct canfd_frame *cf, int ae) 572 { 573 struct isotp_sock *so = isotp_sk(sk); 574 int i; 575 int off; 576 int ff_pci_sz; 577 578 hrtimer_cancel(&so->rxtimer); 579 WRITE_ONCE(so->rx.state, ISOTP_IDLE); 580 581 /* get the used sender LL_DL from the (first) CAN frame data length */ 582 so->rx.ll_dl = padlen(cf->len); 583 584 /* the first frame has to use the entire frame up to LL_DL length */ 585 if (cf->len != so->rx.ll_dl) 586 return 1; 587 588 /* get the FF_DL */ 589 so->rx.len = (cf->data[ae] & 0x0F) << 8; 590 so->rx.len += cf->data[ae + 1]; 591 592 /* Check for FF_DL escape sequence supporting 32 bit PDU length */ 593 if (so->rx.len) { 594 ff_pci_sz = FF_PCI_SZ12; 595 } else { 596 /* FF_DL = 0 => get real length from next 4 bytes */ 597 so->rx.len = cf->data[ae + 2] << 24; 598 so->rx.len += cf->data[ae + 3] << 16; 599 so->rx.len += cf->data[ae + 4] << 8; 600 so->rx.len += cf->data[ae + 5]; 601 ff_pci_sz = FF_PCI_SZ32; 602 } 603 604 /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ 605 off = (so->rx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; 606 607 if (so->rx.len + ae + off + ff_pci_sz < so->rx.ll_dl) 608 return 1; 609 610 /* PDU size > default => try max_pdu_size */ 611 if (so->rx.len > so->rx.buflen && so->rx.buflen < max_pdu_size) { 612 u8 *newbuf = kmalloc(max_pdu_size, GFP_ATOMIC); 613 614 if (newbuf) { 615 so->rx.buf = newbuf; 616 so->rx.buflen = max_pdu_size; 617 } 618 } 619 620 if (so->rx.len > so->rx.buflen) { 621 /* send FC frame with overflow status */ 622 isotp_send_fc(sk, ae, ISOTP_FC_OVFLW); 623 return 1; 624 } 625 626 /* copy the first received data bytes */ 627 so->rx.idx = 0; 628 for (i = ae + ff_pci_sz; i < so->rx.ll_dl; i++) 629 so->rx.buf[so->rx.idx++] = cf->data[i]; 630 631 /* initial setup for this pdu reception */ 632 so->rx.sn = 1; 633 WRITE_ONCE(so->rx.state, ISOTP_WAIT_DATA); 634 635 /* no creation of flow control frames */ 636 if (so->opt.flags & CAN_ISOTP_LISTEN_MODE) 637 return 0; 638 639 /* send our first FC frame */ 640 isotp_send_fc(sk, ae, ISOTP_FC_CTS); 641 return 0; 642 } 643 644 static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae, 645 struct sk_buff *skb) 646 { 647 struct isotp_sock *so = isotp_sk(sk); 648 struct sk_buff *nskb; 649 int i; 650 651 if (READ_ONCE(so->rx.state) != ISOTP_WAIT_DATA) 652 return 0; 653 654 /* drop if timestamp gap is less than force_rx_stmin nano secs */ 655 if (so->opt.flags & CAN_ISOTP_FORCE_RXSTMIN) { 656 if (ktime_to_ns(ktime_sub(skb->tstamp, so->lastrxcf_tstamp)) < 657 so->force_rx_stmin) 658 return 0; 659 660 so->lastrxcf_tstamp = skb->tstamp; 661 } 662 663 hrtimer_cancel(&so->rxtimer); 664 665 /* isotp_rx_timer_handler() may have raced us for so->rx.state 666 * while hrtimer_cancel() above waited for it to finish => recheck 667 */ 668 if (READ_ONCE(so->rx.state) != ISOTP_WAIT_DATA) 669 return 1; 670 671 /* CFs are never longer than the FF */ 672 if (cf->len > so->rx.ll_dl) 673 return 1; 674 675 /* CFs have usually the LL_DL length */ 676 if (cf->len < so->rx.ll_dl) { 677 /* this is only allowed for the last CF */ 678 if (so->rx.len - so->rx.idx > so->rx.ll_dl - ae - N_PCI_SZ) 679 return 1; 680 } 681 682 if ((cf->data[ae] & 0x0F) != so->rx.sn) { 683 /* wrong sn detected - report 'illegal byte sequence' */ 684 sk->sk_err = EILSEQ; 685 if (!sock_flag(sk, SOCK_DEAD)) 686 sk_error_report(sk); 687 688 /* reset rx state */ 689 WRITE_ONCE(so->rx.state, ISOTP_IDLE); 690 return 1; 691 } 692 so->rx.sn++; 693 so->rx.sn %= 16; 694 695 for (i = ae + N_PCI_SZ; i < cf->len; i++) { 696 so->rx.buf[so->rx.idx++] = cf->data[i]; 697 if (so->rx.idx >= so->rx.len) 698 break; 699 } 700 701 if (so->rx.idx >= so->rx.len) { 702 /* we are done */ 703 WRITE_ONCE(so->rx.state, ISOTP_IDLE); 704 705 if ((so->opt.flags & ISOTP_CHECK_PADDING) && 706 check_pad(so, cf, i + 1, so->opt.rxpad_content)) { 707 /* malformed PDU - report 'not a data message' */ 708 sk->sk_err = EBADMSG; 709 if (!sock_flag(sk, SOCK_DEAD)) 710 sk_error_report(sk); 711 return 1; 712 } 713 714 nskb = alloc_skb(so->rx.len, gfp_any()); 715 if (!nskb) 716 return 1; 717 718 memcpy(skb_put(nskb, so->rx.len), so->rx.buf, 719 so->rx.len); 720 721 nskb->tstamp = skb->tstamp; 722 nskb->dev = skb->dev; 723 isotp_rcv_skb(nskb, sk); 724 return 0; 725 } 726 727 /* perform blocksize handling, if enabled */ 728 if (!so->rxfc.bs || ++so->rx.bs < so->rxfc.bs) { 729 /* start rx timeout watchdog */ 730 hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 731 HRTIMER_MODE_REL_SOFT); 732 return 0; 733 } 734 735 /* no creation of flow control frames */ 736 if (so->opt.flags & CAN_ISOTP_LISTEN_MODE) 737 return 0; 738 739 /* we reached the specified blocksize so->rxfc.bs */ 740 isotp_send_fc(sk, ae, ISOTP_FC_CTS); 741 return 0; 742 } 743 744 static void isotp_rcv(struct sk_buff *skb, void *data) 745 { 746 struct sock *sk = (struct sock *)data; 747 struct isotp_sock *so = isotp_sk(sk); 748 struct canfd_frame *cf; 749 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 750 u8 n_pci_type, sf_dl; 751 752 /* Strictly receive only frames with the configured MTU size 753 * => clear separation of CAN2.0 / CAN FD transport channels 754 */ 755 if (skb->len != so->ll.mtu) 756 return; 757 758 cf = (struct canfd_frame *)skb->data; 759 760 /* if enabled: check reception of my configured extended address */ 761 if (ae && cf->data[0] != so->opt.rx_ext_address) 762 return; 763 764 n_pci_type = cf->data[ae] & 0xF0; 765 766 /* Make sure the state changes and data structures stay consistent at 767 * CAN frame reception time. This locking is not needed in real world 768 * use cases but the inconsistency can be triggered with syzkaller. 769 */ 770 spin_lock(&so->rx_lock); 771 772 if (so->opt.flags & CAN_ISOTP_HALF_DUPLEX) { 773 /* check rx/tx path half duplex expectations */ 774 if ((READ_ONCE(so->tx.state) != ISOTP_IDLE && 775 n_pci_type != N_PCI_FC) || 776 (READ_ONCE(so->rx.state) != ISOTP_IDLE && 777 n_pci_type == N_PCI_FC)) 778 goto out_unlock; 779 } 780 781 switch (n_pci_type) { 782 case N_PCI_FC: 783 /* tx path: flow control frame containing the FC parameters */ 784 isotp_rcv_fc(so, cf, ae); 785 break; 786 787 case N_PCI_SF: 788 /* rx path: single frame 789 * 790 * As we do not have a rx.ll_dl configuration, we can only test 791 * if the CAN frames payload length matches the LL_DL == 8 792 * requirements - no matter if it's CAN 2.0 or CAN FD 793 */ 794 795 /* get the SF_DL from the N_PCI byte */ 796 sf_dl = cf->data[ae] & 0x0F; 797 798 if (cf->len <= CAN_MAX_DLEN) { 799 isotp_rcv_sf(sk, cf, SF_PCI_SZ4 + ae, skb, sf_dl); 800 } else { 801 if (can_is_canfd_skb(skb)) { 802 /* We have a CAN FD frame and CAN_DL is greater than 8: 803 * Only frames with the SF_DL == 0 ESC value are valid. 804 * 805 * If so take care of the increased SF PCI size 806 * (SF_PCI_SZ8) to point to the message content behind 807 * the extended SF PCI info and get the real SF_DL 808 * length value from the formerly first data byte. 809 */ 810 if (sf_dl == 0) 811 isotp_rcv_sf(sk, cf, SF_PCI_SZ8 + ae, skb, 812 cf->data[SF_PCI_SZ4 + ae]); 813 } 814 } 815 break; 816 817 case N_PCI_FF: 818 /* rx path: first frame */ 819 isotp_rcv_ff(sk, cf, ae); 820 break; 821 822 case N_PCI_CF: 823 /* rx path: consecutive frame */ 824 isotp_rcv_cf(sk, cf, ae, skb); 825 break; 826 } 827 828 out_unlock: 829 spin_unlock(&so->rx_lock); 830 } 831 832 static void isotp_fill_dataframe(struct canfd_frame *cf, struct isotp_sock *so, 833 int ae, int off) 834 { 835 int pcilen = N_PCI_SZ + ae + off; 836 int space = so->tx.ll_dl - pcilen; 837 int num = min_t(int, so->tx.len - so->tx.idx, space); 838 int i; 839 840 cf->can_id = so->txid; 841 cf->len = num + pcilen; 842 843 if (num < space) { 844 if (so->opt.flags & CAN_ISOTP_TX_PADDING) { 845 /* user requested padding */ 846 cf->len = padlen(cf->len); 847 memset(cf->data, so->opt.txpad_content, cf->len); 848 } else if (cf->len > CAN_MAX_DLEN) { 849 /* mandatory padding for CAN FD frames */ 850 cf->len = padlen(cf->len); 851 memset(cf->data, CAN_ISOTP_DEFAULT_PAD_CONTENT, 852 cf->len); 853 } 854 } 855 856 for (i = 0; i < num; i++) 857 cf->data[pcilen + i] = so->tx.buf[so->tx.idx++]; 858 859 if (ae) 860 cf->data[0] = so->opt.ext_address; 861 } 862 863 static void isotp_send_cframe(struct isotp_sock *so) 864 { 865 struct sock *sk = &so->sk; 866 struct sk_buff *skb; 867 struct can_skb_ext *csx; 868 struct net_device *dev; 869 struct canfd_frame *cf; 870 int can_send_ret; 871 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 872 u32 old_cfecho; 873 874 dev = dev_get_by_index(sock_net(sk), so->ifindex); 875 if (!dev) 876 return; 877 878 skb = alloc_skb(so->ll.mtu, GFP_ATOMIC); 879 if (!skb) { 880 dev_put(dev); 881 return; 882 } 883 884 csx = can_skb_ext_add(skb); 885 if (!csx) { 886 kfree_skb(skb); 887 netdev_put(dev, NULL); 888 return; 889 } 890 891 csx->can_iif = dev->ifindex; 892 893 /* set uid in tx skb to identify CF echo frames */ 894 can_set_skb_uid(csx); 895 896 cf = (struct canfd_frame *)skb->data; 897 skb_put_zero(skb, so->ll.mtu); 898 899 /* create consecutive frame */ 900 isotp_fill_dataframe(cf, so, ae, 0); 901 902 /* place consecutive frame N_PCI in appropriate index */ 903 cf->data[ae] = N_PCI_CF | so->tx.sn++; 904 so->tx.sn %= 16; 905 so->tx.bs++; 906 907 cf->flags = so->ll.tx_flags; 908 909 skb->dev = dev; 910 can_skb_set_owner(skb, sk); 911 912 /* zero'ed by init/isotp_rcv_echo(); reached lock-free via 913 * isotp_txfr_timer_handler() too, so use READ_ONCE()/WRITE_ONCE() 914 */ 915 old_cfecho = READ_ONCE(so->cfecho); 916 if (old_cfecho) 917 pr_notice_once("can-isotp: cfecho is %08X != 0\n", old_cfecho); 918 919 /* set consecutive frame echo tag */ 920 WRITE_ONCE(so->cfecho, csx->can_skb_uid); 921 922 /* send frame with local echo enabled */ 923 can_send_ret = can_send(skb, 1); 924 if (can_send_ret) { 925 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 926 __func__, ERR_PTR(can_send_ret)); 927 if (can_send_ret == -ENOBUFS) 928 pr_notice_once("can-isotp: tx queue is full\n"); 929 } 930 dev_put(dev); 931 } 932 933 static void isotp_create_fframe(struct canfd_frame *cf, struct isotp_sock *so, 934 int ae) 935 { 936 int i; 937 int ff_pci_sz; 938 939 cf->can_id = so->txid; 940 cf->len = so->tx.ll_dl; 941 if (ae) 942 cf->data[0] = so->opt.ext_address; 943 944 /* create N_PCI bytes with 12/32 bit FF_DL data length */ 945 if (so->tx.len > MAX_12BIT_PDU_SIZE) { 946 /* use 32 bit FF_DL notation */ 947 cf->data[ae] = N_PCI_FF; 948 cf->data[ae + 1] = 0; 949 cf->data[ae + 2] = (u8)(so->tx.len >> 24) & 0xFFU; 950 cf->data[ae + 3] = (u8)(so->tx.len >> 16) & 0xFFU; 951 cf->data[ae + 4] = (u8)(so->tx.len >> 8) & 0xFFU; 952 cf->data[ae + 5] = (u8)so->tx.len & 0xFFU; 953 ff_pci_sz = FF_PCI_SZ32; 954 } else { 955 /* use 12 bit FF_DL notation */ 956 cf->data[ae] = (u8)(so->tx.len >> 8) | N_PCI_FF; 957 cf->data[ae + 1] = (u8)so->tx.len & 0xFFU; 958 ff_pci_sz = FF_PCI_SZ12; 959 } 960 961 /* add first data bytes depending on ae */ 962 for (i = ae + ff_pci_sz; i < so->tx.ll_dl; i++) 963 cf->data[i] = so->tx.buf[so->tx.idx++]; 964 965 so->tx.sn = 1; 966 } 967 968 static void isotp_rcv_echo(struct sk_buff *skb, void *data) 969 { 970 struct sock *sk = (struct sock *)data; 971 struct isotp_sock *so = isotp_sk(sk); 972 struct can_skb_ext *csx = can_skb_ext_find(skb); 973 974 /* only handle my own local echo CF/SF skb's (no FF!) */ 975 if (skb->sk != sk) 976 return; 977 978 if (WARN_ON_ONCE(!csx)) 979 return; 980 981 /* unlike isotp_rcv_fc()/isotp_rcv_cf(), not already under so->rx_lock 982 * (no isotp_rcv() caller here), so take it ourselves 983 */ 984 spin_lock(&so->rx_lock); 985 986 /* so->cfecho may since belong to a new transfer; recheck under lock */ 987 if (READ_ONCE(so->cfecho) != csx->can_skb_uid) 988 goto out_unlock; 989 990 /* cancel local echo timeout */ 991 hrtimer_cancel(&so->echotimer); 992 993 /* local echo skb with consecutive frame has been consumed */ 994 WRITE_ONCE(so->cfecho, 0); 995 996 /* claiming a transfer also takes so->rx_lock, so a plain recheck 997 * is enough: so->tx.state can't have flipped to ISOTP_SENDING for 998 * a new claim while we're still in here 999 */ 1000 if (READ_ONCE(so->tx.state) != ISOTP_SENDING) 1001 goto out_unlock; 1002 1003 if (so->tx.idx >= so->tx.len) { 1004 /* we are done */ 1005 1006 isotp_set_tx_result(so, so->tx_gen, 0); 1007 /* set to IDLE after publishing tx_result */ 1008 smp_store_release(&so->tx.state, ISOTP_IDLE); 1009 wake_up_interruptible(&so->wait); 1010 goto out_unlock; 1011 } 1012 1013 if (so->txfc.bs && so->tx.bs >= so->txfc.bs) { 1014 /* stop and wait for FC with timeout */ 1015 WRITE_ONCE(so->tx.state, ISOTP_WAIT_FC); 1016 hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 1017 HRTIMER_MODE_REL_SOFT); 1018 goto out_unlock; 1019 } 1020 1021 /* no gap between data frames needed => use burst mode */ 1022 if (!so->tx_gap) { 1023 /* enable echo timeout handling */ 1024 hrtimer_start(&so->echotimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 1025 HRTIMER_MODE_REL_SOFT); 1026 isotp_send_cframe(so); 1027 goto out_unlock; 1028 } 1029 1030 /* start timer to send next consecutive frame with correct delay */ 1031 hrtimer_start(&so->txfrtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT); 1032 1033 out_unlock: 1034 spin_unlock(&so->rx_lock); 1035 } 1036 1037 /* isotp_tx_timeout: we did not get any flow control or echo frame in time 1038 * 1039 * Shared by so->txtimer's and so->echotimer's callbacks. Both timers get 1040 * cancelled under so->rx_lock elsewhere, so this must stay lock-free. 1041 * 1042 * tx.state is acquired before tx_gen. Common sequence in isotp_tx_gen_done(). 1043 * cmpxchg() only orders itself, not the two preceding loads. 1044 */ 1045 static enum hrtimer_restart isotp_tx_timeout(struct isotp_sock *so) 1046 { 1047 struct sock *sk = &so->sk; 1048 /* read tx.state first for the common sequence */ 1049 u32 old_state = smp_load_acquire(&so->tx.state); 1050 u32 gen = READ_ONCE(so->tx_gen); 1051 1052 /* don't handle timeouts in IDLE or SHUTDOWN state */ 1053 if (old_state == ISOTP_IDLE || old_state == ISOTP_SHUTDOWN) 1054 return HRTIMER_NORESTART; 1055 1056 /* only claim the timeout if the state is still unchanged */ 1057 if (cmpxchg(&so->tx.state, old_state, ISOTP_IDLE) != old_state) 1058 return HRTIMER_NORESTART; 1059 1060 /* detected timeout: report 'communication error on send' */ 1061 1062 /* a stale read of this slot by a waiter still falls back to ECOMM */ 1063 isotp_set_tx_result(so, gen, ECOMM); 1064 1065 sk->sk_err = ECOMM; 1066 if (!sock_flag(sk, SOCK_DEAD)) 1067 sk_error_report(sk); 1068 1069 wake_up_interruptible(&so->wait); 1070 1071 return HRTIMER_NORESTART; 1072 } 1073 1074 /* so->txtimer: fires when a Flow Control frame does not arrive in time */ 1075 static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer) 1076 { 1077 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 1078 txtimer); 1079 1080 return isotp_tx_timeout(so); 1081 } 1082 1083 /* so->echotimer: fires when a sent CF/SF's local echo does not arrive */ 1084 static enum hrtimer_restart isotp_echo_timer_handler(struct hrtimer *hrtimer) 1085 { 1086 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 1087 echotimer); 1088 1089 return isotp_tx_timeout(so); 1090 } 1091 1092 static enum hrtimer_restart isotp_txfr_timer_handler(struct hrtimer *hrtimer) 1093 { 1094 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 1095 txfrtimer); 1096 1097 /* start echo timeout handling and cover below protocol error */ 1098 hrtimer_start(&so->echotimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 1099 HRTIMER_MODE_REL_SOFT); 1100 1101 /* cfecho should be consumed by isotp_rcv_echo() here */ 1102 if (READ_ONCE(so->tx.state) == ISOTP_SENDING && !READ_ONCE(so->cfecho)) 1103 isotp_send_cframe(so); 1104 1105 return HRTIMER_NORESTART; 1106 } 1107 1108 static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 1109 { 1110 struct sock *sk = sock->sk; 1111 struct isotp_sock *so = isotp_sk(sk); 1112 struct sk_buff *skb; 1113 struct can_skb_ext *csx; 1114 struct net_device *dev; 1115 struct canfd_frame *cf; 1116 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 1117 int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0; 1118 s64 hrtimer_sec = ISOTP_ECHO_TIMEOUT; 1119 struct hrtimer *tx_hrt = &so->echotimer; 1120 u32 new_state = ISOTP_SENDING; 1121 u32 my_gen; 1122 u32 old_cfecho; 1123 int off; 1124 int err; 1125 1126 if (!so->bound || READ_ONCE(so->tx.state) == ISOTP_SHUTDOWN) 1127 return -EADDRNOTAVAIL; 1128 1129 /* claim the socket under so->rx_lock: this serializes the claim 1130 * with the RX path and with sendmsg()'s own error paths below, so 1131 * none of them can ever see a transfer mid-claim 1132 */ 1133 for (;;) { 1134 spin_lock_bh(&so->rx_lock); 1135 if (READ_ONCE(so->tx.state) == ISOTP_IDLE) 1136 break; 1137 spin_unlock_bh(&so->rx_lock); 1138 1139 /* we do not support multiple buffers - for now */ 1140 if (msg->msg_flags & MSG_DONTWAIT) 1141 return -EAGAIN; 1142 1143 if (READ_ONCE(so->tx.state) == ISOTP_SHUTDOWN) 1144 return -EADDRNOTAVAIL; 1145 1146 /* wait for complete transmission of current pdu */ 1147 err = wait_event_interruptible(so->wait, 1148 READ_ONCE(so->tx.state) == ISOTP_IDLE || 1149 READ_ONCE(so->tx.state) == ISOTP_SHUTDOWN); 1150 if (err) 1151 return err; 1152 } 1153 1154 /* txfrtimer's callback re-arms echotimer lock-free: drain it first */ 1155 hrtimer_cancel(&so->txfrtimer); 1156 hrtimer_cancel(&so->txtimer); 1157 hrtimer_cancel(&so->echotimer); 1158 1159 /* new transfer: increment so->tx_gen and set tx.state after barrier */ 1160 my_gen = isotp_inc_tx_gen(READ_ONCE(so->tx_gen)); 1161 isotp_set_tx_result(so, my_gen, ECOMM); /* prevent stale slot matching */ 1162 WRITE_ONCE(so->tx_gen, my_gen); 1163 smp_wmb(); /* see smp_load_acquire() in isotp_tx_[timeout|gen_done] */ 1164 WRITE_ONCE(so->tx.state, ISOTP_SENDING); 1165 WRITE_ONCE(so->cfecho, 0); 1166 spin_unlock_bh(&so->rx_lock); 1167 1168 /* so->bound is only checked once above - a wakeup may have 1169 * unbound/rebound the socket meanwhile => recheck 1170 */ 1171 if (!so->bound) { 1172 err = -EADDRNOTAVAIL; 1173 goto err_out_drop; 1174 } 1175 1176 /* PDU size > default => try max_pdu_size */ 1177 if (size > so->tx.buflen && so->tx.buflen < max_pdu_size) { 1178 u8 *newbuf = kmalloc(max_pdu_size, GFP_KERNEL); 1179 1180 if (newbuf) { 1181 so->tx.buf = newbuf; 1182 so->tx.buflen = max_pdu_size; 1183 } 1184 } 1185 1186 if (!size || size > so->tx.buflen) { 1187 err = -EINVAL; 1188 goto err_out_drop; 1189 } 1190 1191 /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ 1192 off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; 1193 1194 /* does the given data fit into a single frame for SF_BROADCAST? */ 1195 if ((isotp_bc_flags(so) == CAN_ISOTP_SF_BROADCAST) && 1196 (size > so->tx.ll_dl - SF_PCI_SZ4 - ae - off)) { 1197 err = -EINVAL; 1198 goto err_out_drop; 1199 } 1200 1201 err = memcpy_from_msg(so->tx.buf, msg, size); 1202 if (err < 0) 1203 goto err_out_drop; 1204 1205 dev = dev_get_by_index(sock_net(sk), so->ifindex); 1206 if (!dev) { 1207 err = -ENXIO; 1208 goto err_out_drop; 1209 } 1210 1211 skb = sock_alloc_send_skb(sk, so->ll.mtu, msg->msg_flags & MSG_DONTWAIT, 1212 &err); 1213 if (!skb) { 1214 dev_put(dev); 1215 goto err_out_drop; 1216 } 1217 1218 csx = can_skb_ext_add(skb); 1219 if (!csx) { 1220 kfree_skb(skb); 1221 netdev_put(dev, NULL); 1222 err = -ENOMEM; 1223 goto err_out_drop; 1224 } 1225 1226 csx->can_iif = dev->ifindex; 1227 1228 /* set uid in tx skb to identify CF echo frames */ 1229 can_set_skb_uid(csx); 1230 1231 so->tx.len = size; 1232 so->tx.idx = 0; 1233 1234 cf = (struct canfd_frame *)skb->data; 1235 skb_put_zero(skb, so->ll.mtu); 1236 1237 /* cfecho should have been zero'ed by init / former isotp_rcv_echo() */ 1238 old_cfecho = READ_ONCE(so->cfecho); 1239 if (old_cfecho) 1240 pr_notice_once("can-isotp: uninit cfecho %08X\n", old_cfecho); 1241 1242 /* check for single frame transmission depending on TX_DL */ 1243 if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) { 1244 /* The message size generally fits into a SingleFrame - good. 1245 * 1246 * SF_DL ESC offset optimization: 1247 * 1248 * When TX_DL is greater 8 but the message would still fit 1249 * into a 8 byte CAN frame, we can omit the offset. 1250 * This prevents a protocol caused length extension from 1251 * CAN_DL = 8 to CAN_DL = 12 due to the SF_SL ESC handling. 1252 */ 1253 if (size <= CAN_MAX_DLEN - SF_PCI_SZ4 - ae) 1254 off = 0; 1255 1256 isotp_fill_dataframe(cf, so, ae, off); 1257 1258 /* place single frame N_PCI w/o length in appropriate index */ 1259 cf->data[ae] = N_PCI_SF; 1260 1261 /* place SF_DL size value depending on the SF_DL ESC offset */ 1262 if (off) 1263 cf->data[SF_PCI_SZ4 + ae] = size; 1264 else 1265 cf->data[ae] |= size; 1266 1267 /* set CF echo tag for isotp_rcv_echo() (SF-mode) */ 1268 WRITE_ONCE(so->cfecho, csx->can_skb_uid); 1269 } else { 1270 /* send first frame */ 1271 1272 isotp_create_fframe(cf, so, ae); 1273 1274 if (isotp_bc_flags(so) == CAN_ISOTP_CF_BROADCAST) { 1275 /* set timer for FC-less operation (STmin = 0) */ 1276 if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) 1277 so->tx_gap = ktime_set(0, so->force_tx_stmin); 1278 else 1279 so->tx_gap = ktime_set(0, so->frame_txtime); 1280 1281 /* disable wait for FCs due to activated block size */ 1282 so->txfc.bs = 0; 1283 1284 /* set CF echo tag for isotp_rcv_echo() (CF-mode) */ 1285 WRITE_ONCE(so->cfecho, csx->can_skb_uid); 1286 } else { 1287 /* standard flow control check */ 1288 new_state = ISOTP_WAIT_FIRST_FC; 1289 1290 /* start timeout for FC */ 1291 hrtimer_sec = ISOTP_FC_TIMEOUT; 1292 tx_hrt = &so->txtimer; 1293 1294 /* no CF echo tag for isotp_rcv_echo() (FF-mode) */ 1295 WRITE_ONCE(so->cfecho, 0); 1296 } 1297 } 1298 1299 spin_lock_bh(&so->rx_lock); 1300 if (READ_ONCE(so->tx.state) == ISOTP_SHUTDOWN) { 1301 /* isotp_release() has since taken over and already drained 1302 * our timers - don't send into a socket that's going away 1303 */ 1304 spin_unlock_bh(&so->rx_lock); 1305 kfree_skb(skb); 1306 dev_put(dev); 1307 wake_up_interruptible(&so->wait); 1308 return -EADDRNOTAVAIL; 1309 } 1310 /* WAIT_FIRST_FC for standard FF, else stays ISOTP_SENDING */ 1311 WRITE_ONCE(so->tx.state, new_state); 1312 hrtimer_start(tx_hrt, ktime_set(hrtimer_sec, 0), 1313 HRTIMER_MODE_REL_SOFT); 1314 spin_unlock_bh(&so->rx_lock); 1315 1316 /* send the first or only CAN frame */ 1317 cf->flags = so->ll.tx_flags; 1318 1319 skb->dev = dev; 1320 skb->sk = sk; 1321 err = can_send(skb, 1); 1322 dev_put(dev); 1323 if (err) { 1324 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 1325 __func__, ERR_PTR(err)); 1326 1327 spin_lock_bh(&so->rx_lock); 1328 1329 /* new transfer already claimed by a concurrent completion, 1330 * timeout or sendmsg() while we were stuck in can_send()? 1331 */ 1332 if (READ_ONCE(so->tx_gen) != my_gen) { 1333 /* don't touch timers and state of the new transfer */ 1334 spin_unlock_bh(&so->rx_lock); 1335 return err; 1336 } 1337 1338 /* no transmission -> no timeout monitoring */ 1339 hrtimer_cancel(tx_hrt); 1340 goto err_out_drop_locked; 1341 } 1342 1343 if (wait_tx_done) { 1344 /* wake up for: 1345 * - concurrent sendmsg() claiming a new transfer 1346 * - complete transmission of current PDU 1347 * - shutdown state change in isotp_release() 1348 * isotp_tx_gen_done() uses common tx.state/tx_gen read sequence 1349 */ 1350 err = wait_event_interruptible(so->wait, 1351 isotp_tx_gen_done(so, my_gen)); 1352 if (err) 1353 goto err_event_drop; 1354 1355 /* still our claim, but isotp_release() force-shut it down */ 1356 if (smp_load_acquire(&so->tx.state) == ISOTP_SHUTDOWN && 1357 READ_ONCE(so->tx_gen) == my_gen) { 1358 err = -EADDRNOTAVAIL; 1359 goto err_event_drop; 1360 } 1361 1362 /* own completion, or tx_gen moved on - either way this is 1363 * what isotp_get_tx_result() recorded for my_gen 1364 */ 1365 err = isotp_get_tx_result(so, my_gen); 1366 1367 /* drain to avoid stale error for a later poll()/SO_ERROR */ 1368 sock_error(sk); 1369 1370 return err ? err : size; 1371 } 1372 1373 return size; 1374 1375 err_out_drop: 1376 /* claimed but nothing sent yet - no timer to cancel */ 1377 spin_lock_bh(&so->rx_lock); 1378 goto err_out_drop_locked; 1379 err_event_drop: 1380 /* interrupted or shut down while waiting on our own transfer */ 1381 spin_lock_bh(&so->rx_lock); 1382 1383 /* new transfer already started by concurrent sendmsg()? */ 1384 if (READ_ONCE(so->tx_gen) != my_gen) { 1385 /* don't touch timers and states of the new transfer */ 1386 spin_unlock_bh(&so->rx_lock); 1387 return err; 1388 } 1389 1390 hrtimer_cancel(&so->txfrtimer); 1391 hrtimer_cancel(&so->txtimer); 1392 hrtimer_cancel(&so->echotimer); 1393 err_out_drop_locked: 1394 /* release the claim; so->rx_lock still held from above */ 1395 WRITE_ONCE(so->cfecho, 0); 1396 1397 /* only claim to IDLE if isotp_release() has not taken over */ 1398 if (READ_ONCE(so->tx.state) != ISOTP_SHUTDOWN) 1399 WRITE_ONCE(so->tx.state, ISOTP_IDLE); 1400 spin_unlock_bh(&so->rx_lock); 1401 wake_up_interruptible(&so->wait); 1402 1403 return err; 1404 } 1405 1406 static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 1407 int flags) 1408 { 1409 struct sock *sk = sock->sk; 1410 struct sk_buff *skb; 1411 struct isotp_sock *so = isotp_sk(sk); 1412 int ret = 0; 1413 1414 if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK | MSG_CMSG_COMPAT)) 1415 return -EINVAL; 1416 1417 if (!so->bound) 1418 return -EADDRNOTAVAIL; 1419 1420 skb = skb_recv_datagram(sk, flags, &ret); 1421 if (!skb) 1422 return ret; 1423 1424 if (size < skb->len) 1425 msg->msg_flags |= MSG_TRUNC; 1426 else 1427 size = skb->len; 1428 1429 ret = memcpy_to_msg(msg, skb->data, size); 1430 if (ret < 0) 1431 goto out_err; 1432 1433 sock_recv_cmsgs(msg, sk, skb); 1434 1435 if (msg->msg_name) { 1436 __sockaddr_check_size(ISOTP_MIN_NAMELEN); 1437 msg->msg_namelen = ISOTP_MIN_NAMELEN; 1438 memcpy(msg->msg_name, skb->cb, msg->msg_namelen); 1439 } 1440 1441 /* set length of return value */ 1442 ret = (flags & MSG_TRUNC) ? skb->len : size; 1443 1444 out_err: 1445 skb_free_datagram(sk, skb); 1446 1447 return ret; 1448 } 1449 1450 static int isotp_release(struct socket *sock) 1451 { 1452 struct sock *sk = sock->sk; 1453 struct isotp_sock *so; 1454 struct net *net; 1455 1456 if (!sk) 1457 return 0; 1458 1459 so = isotp_sk(sk); 1460 net = sock_net(sk); 1461 1462 /* best-effort: wait for a running pdu to finish, but don't block on 1463 * it forever - give up after the first signal 1464 */ 1465 while (READ_ONCE(so->tx.state) != ISOTP_IDLE && 1466 wait_event_interruptible(so->wait, 1467 READ_ONCE(so->tx.state) == ISOTP_IDLE) == 0) 1468 ; 1469 1470 /* claim the socket under so->rx_lock like sendmsg() does, so its 1471 * claim can't race the forced ISOTP_SHUTDOWN below; force it 1472 * unconditionally, even when a signal cut the wait above short 1473 */ 1474 spin_lock_bh(&so->rx_lock); 1475 WRITE_ONCE(so->tx.state, ISOTP_SHUTDOWN); 1476 spin_unlock_bh(&so->rx_lock); 1477 WRITE_ONCE(so->rx.state, ISOTP_IDLE); 1478 1479 /* forced SHUTDOWN may have skipped IDLE (gave up on a signal) */ 1480 wake_up_interruptible(&so->wait); 1481 1482 spin_lock(&isotp_notifier_lock); 1483 while (isotp_busy_notifier == so) { 1484 spin_unlock(&isotp_notifier_lock); 1485 schedule_timeout_uninterruptible(1); 1486 spin_lock(&isotp_notifier_lock); 1487 } 1488 list_del(&so->notifier); 1489 spin_unlock(&isotp_notifier_lock); 1490 1491 rtnl_lock(); 1492 lock_sock(sk); 1493 1494 /* remove current filters & unregister 1495 * tracked reference so->dev is taken at bind() time with rtnl_lock 1496 */ 1497 if (so->bound && so->dev) { 1498 if (isotp_register_rxid(so)) 1499 can_rx_unregister(net, so->dev, so->rxid, 1500 SINGLE_MASK(so->rxid), 1501 isotp_rcv, sk); 1502 1503 can_rx_unregister(net, so->dev, so->txid, 1504 SINGLE_MASK(so->txid), 1505 isotp_rcv_echo, sk); 1506 netdev_put(so->dev, &so->dev_tracker); 1507 } 1508 1509 so->ifindex = 0; 1510 so->bound = 0; 1511 so->dev = NULL; 1512 1513 rtnl_unlock(); 1514 1515 /* Always wait for a grace period before touching the timers below. 1516 * A concurrent NETDEV_UNREGISTER may have already unregistered our 1517 * filters and cleared so->bound in isotp_notify() without waiting 1518 * for in-flight isotp_rcv() callers to finish, so this call must not 1519 * be skipped just because so->bound is already 0 here. 1520 */ 1521 synchronize_rcu(); 1522 1523 hrtimer_cancel(&so->txfrtimer); 1524 hrtimer_cancel(&so->txtimer); 1525 hrtimer_cancel(&so->echotimer); 1526 hrtimer_cancel(&so->rxtimer); 1527 1528 sock_orphan(sk); 1529 sock->sk = NULL; 1530 1531 release_sock(sk); 1532 sock_prot_inuse_add(net, sk->sk_prot, -1); 1533 sock_put(sk); 1534 1535 return 0; 1536 } 1537 1538 static int isotp_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int len) 1539 { 1540 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 1541 struct sock *sk = sock->sk; 1542 struct isotp_sock *so = isotp_sk(sk); 1543 struct net *net = sock_net(sk); 1544 int ifindex; 1545 struct net_device *dev; 1546 canid_t tx_id = addr->can_addr.tp.tx_id; 1547 canid_t rx_id = addr->can_addr.tp.rx_id; 1548 int err = 0; 1549 int notify_enetdown = 0; 1550 1551 if (len < ISOTP_MIN_NAMELEN) 1552 return -EINVAL; 1553 1554 if (addr->can_family != AF_CAN) 1555 return -EINVAL; 1556 1557 /* sanitize tx CAN identifier */ 1558 if (tx_id & CAN_EFF_FLAG) 1559 tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); 1560 else 1561 tx_id &= CAN_SFF_MASK; 1562 1563 /* give feedback on wrong CAN-ID value */ 1564 if (tx_id != addr->can_addr.tp.tx_id) 1565 return -EINVAL; 1566 1567 /* sanitize rx CAN identifier (if needed) */ 1568 if (isotp_register_rxid(so)) { 1569 if (rx_id & CAN_EFF_FLAG) 1570 rx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); 1571 else 1572 rx_id &= CAN_SFF_MASK; 1573 1574 /* give feedback on wrong CAN-ID value */ 1575 if (rx_id != addr->can_addr.tp.rx_id) 1576 return -EINVAL; 1577 } 1578 1579 if (!addr->can_ifindex) 1580 return -ENODEV; 1581 1582 rtnl_lock(); 1583 lock_sock(sk); 1584 1585 if (so->bound) { 1586 err = -EINVAL; 1587 goto out; 1588 } 1589 1590 /* A transmission or reception that outlived a previous binding 1591 * (unbound by NETDEV_UNREGISTER) may still be draining; the FC/echo 1592 * and RX watchdog timers bound how long this takes. Checked together 1593 * with so->bound in the same lock_sock() section above, so there is 1594 * no window in which a concurrent isotp_notify() could be missed. 1595 */ 1596 if (READ_ONCE(so->tx.state) != ISOTP_IDLE || 1597 READ_ONCE(so->rx.state) != ISOTP_IDLE) { 1598 err = -EAGAIN; 1599 goto out; 1600 } 1601 1602 /* ensure different CAN IDs when the rx_id is to be registered */ 1603 if (isotp_register_rxid(so) && rx_id == tx_id) { 1604 err = -EADDRNOTAVAIL; 1605 goto out; 1606 } 1607 1608 dev = dev_get_by_index(net, addr->can_ifindex); 1609 if (!dev) { 1610 err = -ENODEV; 1611 goto out; 1612 } 1613 if (dev->type != ARPHRD_CAN) { 1614 err = -ENODEV; 1615 goto out_put_dev; 1616 } 1617 if (READ_ONCE(dev->mtu) < so->ll.mtu) { 1618 err = -EINVAL; 1619 goto out_put_dev; 1620 } 1621 if (!(dev->flags & IFF_UP)) 1622 notify_enetdown = 1; 1623 1624 ifindex = dev->ifindex; 1625 1626 if (isotp_register_rxid(so)) 1627 can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id), 1628 isotp_rcv, sk, "isotp", sk); 1629 1630 /* no consecutive frame echo skb in flight */ 1631 WRITE_ONCE(so->cfecho, 0); 1632 1633 /* register for echo skb's */ 1634 can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id), 1635 isotp_rcv_echo, sk, "isotpe", sk); 1636 1637 /* switch to new settings */ 1638 so->ifindex = ifindex; 1639 so->rxid = rx_id; 1640 so->txid = tx_id; 1641 so->bound = 1; 1642 1643 /* bind() ok -> hold a reference for so->dev so that isotp_release() 1644 * can safely reach the device later, even if a concurrent 1645 * NETDEV_UNREGISTER has already unlisted it by ifindex. 1646 */ 1647 so->dev = dev; 1648 netdev_hold(so->dev, &so->dev_tracker, GFP_KERNEL); 1649 1650 out_put_dev: 1651 /* remove potential reference from dev_get_by_index() */ 1652 dev_put(dev); 1653 out: 1654 release_sock(sk); 1655 rtnl_unlock(); 1656 1657 if (notify_enetdown) { 1658 sk->sk_err = ENETDOWN; 1659 if (!sock_flag(sk, SOCK_DEAD)) 1660 sk_error_report(sk); 1661 } 1662 1663 return err; 1664 } 1665 1666 static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer) 1667 { 1668 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 1669 struct sock *sk = sock->sk; 1670 struct isotp_sock *so = isotp_sk(sk); 1671 1672 if (peer) 1673 return -EOPNOTSUPP; 1674 1675 memset(addr, 0, ISOTP_MIN_NAMELEN); 1676 addr->can_family = AF_CAN; 1677 addr->can_ifindex = so->ifindex; 1678 addr->can_addr.tp.rx_id = so->rxid; 1679 addr->can_addr.tp.tx_id = so->txid; 1680 1681 return ISOTP_MIN_NAMELEN; 1682 } 1683 1684 static int isotp_setsockopt_locked(struct socket *sock, int level, int optname, 1685 sockptr_t optval, unsigned int optlen) 1686 { 1687 struct sock *sk = sock->sk; 1688 struct isotp_sock *so = isotp_sk(sk); 1689 int ret = 0; 1690 1691 if (so->bound) 1692 return -EISCONN; 1693 1694 switch (optname) { 1695 case CAN_ISOTP_OPTS: 1696 if (optlen != sizeof(struct can_isotp_options)) 1697 return -EINVAL; 1698 1699 if (copy_from_sockptr(&so->opt, optval, optlen)) 1700 return -EFAULT; 1701 1702 /* no separate rx_ext_address is given => use ext_address */ 1703 if (!(so->opt.flags & CAN_ISOTP_RX_EXT_ADDR)) 1704 so->opt.rx_ext_address = so->opt.ext_address; 1705 1706 /* these broadcast flags are not allowed together */ 1707 if (isotp_bc_flags(so) == ISOTP_ALL_BC_FLAGS) { 1708 /* CAN_ISOTP_SF_BROADCAST is prioritized */ 1709 so->opt.flags &= ~CAN_ISOTP_CF_BROADCAST; 1710 1711 /* give user feedback on wrong config attempt */ 1712 ret = -EINVAL; 1713 } 1714 1715 /* check for frame_txtime changes (0 => no changes) */ 1716 if (so->opt.frame_txtime) { 1717 if (so->opt.frame_txtime == CAN_ISOTP_FRAME_TXTIME_ZERO) 1718 so->frame_txtime = 0; 1719 else 1720 so->frame_txtime = so->opt.frame_txtime; 1721 } 1722 break; 1723 1724 case CAN_ISOTP_RECV_FC: 1725 if (optlen != sizeof(struct can_isotp_fc_options)) 1726 return -EINVAL; 1727 1728 if (copy_from_sockptr(&so->rxfc, optval, optlen)) 1729 return -EFAULT; 1730 break; 1731 1732 case CAN_ISOTP_TX_STMIN: 1733 if (optlen != sizeof(u32)) 1734 return -EINVAL; 1735 1736 if (copy_from_sockptr(&so->force_tx_stmin, optval, optlen)) 1737 return -EFAULT; 1738 break; 1739 1740 case CAN_ISOTP_RX_STMIN: 1741 if (optlen != sizeof(u32)) 1742 return -EINVAL; 1743 1744 if (copy_from_sockptr(&so->force_rx_stmin, optval, optlen)) 1745 return -EFAULT; 1746 break; 1747 1748 case CAN_ISOTP_LL_OPTS: 1749 if (optlen == sizeof(struct can_isotp_ll_options)) { 1750 struct can_isotp_ll_options ll; 1751 1752 if (copy_from_sockptr(&ll, optval, optlen)) 1753 return -EFAULT; 1754 1755 /* check for correct ISO 11898-1 DLC data length */ 1756 if (ll.tx_dl != padlen(ll.tx_dl)) 1757 return -EINVAL; 1758 1759 if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU) 1760 return -EINVAL; 1761 1762 if (ll.mtu == CAN_MTU && 1763 (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0)) 1764 return -EINVAL; 1765 1766 memcpy(&so->ll, &ll, sizeof(ll)); 1767 1768 /* set ll_dl for tx path to similar place as for rx */ 1769 so->tx.ll_dl = ll.tx_dl; 1770 } else { 1771 return -EINVAL; 1772 } 1773 break; 1774 1775 default: 1776 ret = -ENOPROTOOPT; 1777 } 1778 1779 return ret; 1780 } 1781 1782 static int isotp_setsockopt(struct socket *sock, int level, int optname, 1783 sockptr_t optval, unsigned int optlen) 1784 1785 { 1786 struct sock *sk = sock->sk; 1787 int ret; 1788 1789 if (level != SOL_CAN_ISOTP) 1790 return -EINVAL; 1791 1792 lock_sock(sk); 1793 ret = isotp_setsockopt_locked(sock, level, optname, optval, optlen); 1794 release_sock(sk); 1795 return ret; 1796 } 1797 1798 static int isotp_getsockopt(struct socket *sock, int level, int optname, 1799 char __user *optval, int __user *optlen) 1800 { 1801 struct sock *sk = sock->sk; 1802 struct isotp_sock *so = isotp_sk(sk); 1803 int len; 1804 void *val; 1805 1806 if (level != SOL_CAN_ISOTP) 1807 return -EINVAL; 1808 if (get_user(len, optlen)) 1809 return -EFAULT; 1810 if (len < 0) 1811 return -EINVAL; 1812 1813 switch (optname) { 1814 case CAN_ISOTP_OPTS: 1815 len = min_t(int, len, sizeof(struct can_isotp_options)); 1816 val = &so->opt; 1817 break; 1818 1819 case CAN_ISOTP_RECV_FC: 1820 len = min_t(int, len, sizeof(struct can_isotp_fc_options)); 1821 val = &so->rxfc; 1822 break; 1823 1824 case CAN_ISOTP_TX_STMIN: 1825 len = min_t(int, len, sizeof(u32)); 1826 val = &so->force_tx_stmin; 1827 break; 1828 1829 case CAN_ISOTP_RX_STMIN: 1830 len = min_t(int, len, sizeof(u32)); 1831 val = &so->force_rx_stmin; 1832 break; 1833 1834 case CAN_ISOTP_LL_OPTS: 1835 len = min_t(int, len, sizeof(struct can_isotp_ll_options)); 1836 val = &so->ll; 1837 break; 1838 1839 default: 1840 return -ENOPROTOOPT; 1841 } 1842 1843 if (put_user(len, optlen)) 1844 return -EFAULT; 1845 if (copy_to_user(optval, val, len)) 1846 return -EFAULT; 1847 return 0; 1848 } 1849 1850 static void isotp_notify(struct isotp_sock *so, unsigned long msg, 1851 struct net_device *dev) 1852 { 1853 struct sock *sk = &so->sk; 1854 1855 if (!net_eq(dev_net(dev), sock_net(sk))) 1856 return; 1857 1858 if (so->dev != dev) 1859 return; 1860 1861 switch (msg) { 1862 case NETDEV_UNREGISTER: 1863 lock_sock(sk); 1864 /* remove current filters & unregister */ 1865 if (so->bound) { 1866 if (isotp_register_rxid(so)) 1867 can_rx_unregister(dev_net(dev), dev, so->rxid, 1868 SINGLE_MASK(so->rxid), 1869 isotp_rcv, sk); 1870 1871 can_rx_unregister(dev_net(dev), dev, so->txid, 1872 SINGLE_MASK(so->txid), 1873 isotp_rcv_echo, sk); 1874 netdev_put(so->dev, &so->dev_tracker); 1875 } 1876 1877 so->ifindex = 0; 1878 so->bound = 0; 1879 so->dev = NULL; 1880 release_sock(sk); 1881 1882 sk->sk_err = ENODEV; 1883 if (!sock_flag(sk, SOCK_DEAD)) 1884 sk_error_report(sk); 1885 break; 1886 1887 case NETDEV_DOWN: 1888 sk->sk_err = ENETDOWN; 1889 if (!sock_flag(sk, SOCK_DEAD)) 1890 sk_error_report(sk); 1891 break; 1892 } 1893 } 1894 1895 static int isotp_notifier(struct notifier_block *nb, unsigned long msg, 1896 void *ptr) 1897 { 1898 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1899 1900 if (dev->type != ARPHRD_CAN) 1901 return NOTIFY_DONE; 1902 if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) 1903 return NOTIFY_DONE; 1904 if (unlikely(isotp_busy_notifier)) /* Check for reentrant bug. */ 1905 return NOTIFY_DONE; 1906 1907 spin_lock(&isotp_notifier_lock); 1908 list_for_each_entry(isotp_busy_notifier, &isotp_notifier_list, notifier) { 1909 spin_unlock(&isotp_notifier_lock); 1910 isotp_notify(isotp_busy_notifier, msg, dev); 1911 spin_lock(&isotp_notifier_lock); 1912 } 1913 isotp_busy_notifier = NULL; 1914 spin_unlock(&isotp_notifier_lock); 1915 return NOTIFY_DONE; 1916 } 1917 1918 static void isotp_sock_destruct(struct sock *sk) 1919 { 1920 struct isotp_sock *so = isotp_sk(sk); 1921 1922 /* do the standard CAN sock destruct work */ 1923 can_sock_destruct(sk); 1924 1925 /* free potential extended PDU buffers */ 1926 if (so->rx.buf != so->rx.sbuf) 1927 kfree(so->rx.buf); 1928 1929 if (so->tx.buf != so->tx.sbuf) 1930 kfree(so->tx.buf); 1931 } 1932 1933 static int isotp_init(struct sock *sk) 1934 { 1935 struct isotp_sock *so = isotp_sk(sk); 1936 1937 so->ifindex = 0; 1938 so->bound = 0; 1939 so->dev = NULL; 1940 1941 so->opt.flags = CAN_ISOTP_DEFAULT_FLAGS; 1942 so->opt.ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS; 1943 so->opt.rx_ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS; 1944 so->opt.rxpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; 1945 so->opt.txpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; 1946 so->opt.frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; 1947 so->frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; 1948 so->rxfc.bs = CAN_ISOTP_DEFAULT_RECV_BS; 1949 so->rxfc.stmin = CAN_ISOTP_DEFAULT_RECV_STMIN; 1950 so->rxfc.wftmax = CAN_ISOTP_DEFAULT_RECV_WFTMAX; 1951 so->ll.mtu = CAN_ISOTP_DEFAULT_LL_MTU; 1952 so->ll.tx_dl = CAN_ISOTP_DEFAULT_LL_TX_DL; 1953 so->ll.tx_flags = CAN_ISOTP_DEFAULT_LL_TX_FLAGS; 1954 1955 /* set ll_dl for tx path to similar place as for rx */ 1956 so->tx.ll_dl = so->ll.tx_dl; 1957 1958 so->rx.state = ISOTP_IDLE; 1959 so->tx.state = ISOTP_IDLE; 1960 1961 so->rx.buf = so->rx.sbuf; 1962 so->tx.buf = so->tx.sbuf; 1963 so->rx.buflen = ARRAY_SIZE(so->rx.sbuf); 1964 so->tx.buflen = ARRAY_SIZE(so->tx.sbuf); 1965 1966 hrtimer_setup(&so->rxtimer, isotp_rx_timer_handler, 1967 CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1968 hrtimer_setup(&so->txtimer, isotp_tx_timer_handler, 1969 CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1970 hrtimer_setup(&so->echotimer, isotp_echo_timer_handler, 1971 CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1972 hrtimer_setup(&so->txfrtimer, isotp_txfr_timer_handler, 1973 CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1974 1975 init_waitqueue_head(&so->wait); 1976 spin_lock_init(&so->rx_lock); 1977 1978 spin_lock(&isotp_notifier_lock); 1979 list_add_tail(&so->notifier, &isotp_notifier_list); 1980 spin_unlock(&isotp_notifier_lock); 1981 1982 /* re-assign default can_sock_destruct() reference */ 1983 sk->sk_destruct = isotp_sock_destruct; 1984 1985 return 0; 1986 } 1987 1988 static __poll_t isotp_poll(struct file *file, struct socket *sock, poll_table *wait) 1989 { 1990 struct sock *sk = sock->sk; 1991 struct isotp_sock *so = isotp_sk(sk); 1992 1993 __poll_t mask = datagram_poll(file, sock, wait); 1994 poll_wait(file, &so->wait, wait); 1995 1996 /* Check for false positives due to TX state */ 1997 if ((mask & EPOLLWRNORM) && (READ_ONCE(so->tx.state) != ISOTP_IDLE)) 1998 mask &= ~(EPOLLOUT | EPOLLWRNORM); 1999 2000 return mask; 2001 } 2002 2003 static int isotp_sock_no_ioctlcmd(struct socket *sock, unsigned int cmd, 2004 unsigned long arg) 2005 { 2006 /* no ioctls for socket layer -> hand it down to NIC layer */ 2007 return -ENOIOCTLCMD; 2008 } 2009 2010 static const struct proto_ops isotp_ops = { 2011 .family = PF_CAN, 2012 .release = isotp_release, 2013 .bind = isotp_bind, 2014 .connect = sock_no_connect, 2015 .socketpair = sock_no_socketpair, 2016 .accept = sock_no_accept, 2017 .getname = isotp_getname, 2018 .poll = isotp_poll, 2019 .ioctl = isotp_sock_no_ioctlcmd, 2020 .gettstamp = sock_gettstamp, 2021 .listen = sock_no_listen, 2022 .shutdown = sock_no_shutdown, 2023 .setsockopt = isotp_setsockopt, 2024 .getsockopt = isotp_getsockopt, 2025 .sendmsg = isotp_sendmsg, 2026 .recvmsg = isotp_recvmsg, 2027 .mmap = sock_no_mmap, 2028 }; 2029 2030 static struct proto isotp_proto __read_mostly = { 2031 .name = "CAN_ISOTP", 2032 .owner = THIS_MODULE, 2033 .obj_size = sizeof(struct isotp_sock), 2034 .init = isotp_init, 2035 }; 2036 2037 static const struct can_proto isotp_can_proto = { 2038 .type = SOCK_DGRAM, 2039 .protocol = CAN_ISOTP, 2040 .ops = &isotp_ops, 2041 .prot = &isotp_proto, 2042 }; 2043 2044 static struct notifier_block canisotp_notifier = { 2045 .notifier_call = isotp_notifier 2046 }; 2047 2048 static __init int isotp_module_init(void) 2049 { 2050 int err; 2051 2052 max_pdu_size = max_t(unsigned int, max_pdu_size, MAX_12BIT_PDU_SIZE); 2053 max_pdu_size = min_t(unsigned int, max_pdu_size, MAX_PDU_SIZE); 2054 2055 pr_info("can: isotp protocol (max_pdu_size %d)\n", max_pdu_size); 2056 2057 err = register_netdevice_notifier(&canisotp_notifier); 2058 if (err) 2059 return err; 2060 2061 err = can_proto_register(&isotp_can_proto); 2062 if (err < 0) { 2063 pr_err("can: registration of isotp protocol failed %pe\n", ERR_PTR(err)); 2064 unregister_netdevice_notifier(&canisotp_notifier); 2065 return err; 2066 } 2067 2068 return 0; 2069 } 2070 2071 static __exit void isotp_module_exit(void) 2072 { 2073 can_proto_unregister(&isotp_can_proto); 2074 unregister_netdevice_notifier(&canisotp_notifier); 2075 } 2076 2077 module_init(isotp_module_init); 2078 module_exit(isotp_module_exit); 2079