1 // SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) 2 /* isotp.c - ISO 15765-2 CAN transport protocol for protocol family CAN 3 * 4 * This implementation does not provide ISO-TP specific return values to the 5 * userspace. 6 * 7 * - RX path timeout of data reception leads to -ETIMEDOUT 8 * - RX path SN mismatch leads to -EILSEQ 9 * - RX path data reception with wrong padding leads to -EBADMSG 10 * - TX path flowcontrol reception timeout leads to -ECOMM 11 * - TX path flowcontrol reception overflow leads to -EMSGSIZE 12 * - TX path flowcontrol reception with wrong layout/padding leads to -EBADMSG 13 * - when a transfer (tx) is on the run the next write() blocks until it's done 14 * - use CAN_ISOTP_WAIT_TX_DONE flag to block the caller until the PDU is sent 15 * - as we have static buffers the check whether the PDU fits into the buffer 16 * is done at FF reception time (no support for sending 'wait frames') 17 * 18 * Copyright (c) 2020 Volkswagen Group Electronic Research 19 * All rights reserved. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 3. Neither the name of Volkswagen nor the names of its contributors 30 * may be used to endorse or promote products derived from this software 31 * without specific prior written permission. 32 * 33 * Alternatively, provided that this notice is retained in full, this 34 * software may be distributed under the terms of the GNU General 35 * Public License ("GPL") version 2, in which case the provisions of the 36 * GPL apply INSTEAD OF those given above. 37 * 38 * The provided data structures and external interfaces from this code 39 * are not restricted to be used by modules with a GPL compatible license. 40 * 41 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 42 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 43 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 44 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 45 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 46 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 47 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 48 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 49 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 50 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 51 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH 52 * DAMAGE. 53 */ 54 55 #include <linux/module.h> 56 #include <linux/init.h> 57 #include <linux/interrupt.h> 58 #include <linux/spinlock.h> 59 #include <linux/hrtimer.h> 60 #include <linux/wait.h> 61 #include <linux/uio.h> 62 #include <linux/net.h> 63 #include <linux/netdevice.h> 64 #include <linux/socket.h> 65 #include <linux/if_arp.h> 66 #include <linux/skbuff.h> 67 #include <linux/can.h> 68 #include <linux/can/core.h> 69 #include <linux/can/skb.h> 70 #include <linux/can/isotp.h> 71 #include <linux/slab.h> 72 #include <net/sock.h> 73 #include <net/net_namespace.h> 74 75 MODULE_DESCRIPTION("PF_CAN ISO 15765-2 transport protocol"); 76 MODULE_LICENSE("Dual BSD/GPL"); 77 MODULE_AUTHOR("Oliver Hartkopp <socketcan@hartkopp.net>"); 78 MODULE_ALIAS("can-proto-6"); 79 80 #define ISOTP_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp) 81 82 #define SINGLE_MASK(id) (((id) & CAN_EFF_FLAG) ? \ 83 (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \ 84 (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG)) 85 86 /* Since ISO 15765-2:2016 the CAN isotp protocol supports more than 4095 87 * byte per ISO PDU as the FF_DL can take full 32 bit values (4 Gbyte). 88 * We would need some good concept to handle this between user space and 89 * kernel space. For now set the static buffer to something about 8 kbyte 90 * to be able to test this new functionality. 91 */ 92 #define DEFAULT_MAX_PDU_SIZE 8300 93 94 /* maximum PDU size before ISO 15765-2:2016 extension was 4095 */ 95 #define MAX_12BIT_PDU_SIZE 4095 96 97 /* limit the isotp pdu size from the optional module parameter to 1MByte */ 98 #define MAX_PDU_SIZE (1025 * 1024U) 99 100 static unsigned int max_pdu_size __read_mostly = DEFAULT_MAX_PDU_SIZE; 101 module_param(max_pdu_size, uint, 0444); 102 MODULE_PARM_DESC(max_pdu_size, "maximum isotp pdu size (default " 103 __stringify(DEFAULT_MAX_PDU_SIZE) ")"); 104 105 /* N_PCI type values in bits 7-4 of N_PCI bytes */ 106 #define N_PCI_SF 0x00 /* single frame */ 107 #define N_PCI_FF 0x10 /* first frame */ 108 #define N_PCI_CF 0x20 /* consecutive frame */ 109 #define N_PCI_FC 0x30 /* flow control */ 110 111 #define N_PCI_SZ 1 /* size of the PCI byte #1 */ 112 #define SF_PCI_SZ4 1 /* size of SingleFrame PCI including 4 bit SF_DL */ 113 #define SF_PCI_SZ8 2 /* size of SingleFrame PCI including 8 bit SF_DL */ 114 #define FF_PCI_SZ12 2 /* size of FirstFrame PCI including 12 bit FF_DL */ 115 #define FF_PCI_SZ32 6 /* size of FirstFrame PCI including 32 bit FF_DL */ 116 #define FC_CONTENT_SZ 3 /* flow control content size in byte (FS/BS/STmin) */ 117 118 #define ISOTP_CHECK_PADDING (CAN_ISOTP_CHK_PAD_LEN | CAN_ISOTP_CHK_PAD_DATA) 119 #define ISOTP_ALL_BC_FLAGS (CAN_ISOTP_SF_BROADCAST | CAN_ISOTP_CF_BROADCAST) 120 121 /* Flow Status given in FC frame */ 122 #define ISOTP_FC_CTS 0 /* clear to send */ 123 #define ISOTP_FC_WT 1 /* wait */ 124 #define ISOTP_FC_OVFLW 2 /* overflow */ 125 126 #define ISOTP_FC_TIMEOUT 1 /* 1 sec */ 127 #define ISOTP_ECHO_TIMEOUT 2 /* 2 secs */ 128 129 enum { 130 ISOTP_IDLE = 0, 131 ISOTP_WAIT_FIRST_FC, 132 ISOTP_WAIT_FC, 133 ISOTP_WAIT_DATA, 134 ISOTP_SENDING, 135 ISOTP_SHUTDOWN, 136 }; 137 138 struct tpcon { 139 u8 *buf; 140 unsigned int buflen; 141 unsigned int len; 142 unsigned int idx; 143 u32 state; 144 u8 bs; 145 u8 sn; 146 u8 ll_dl; 147 u8 sbuf[DEFAULT_MAX_PDU_SIZE]; 148 }; 149 150 struct isotp_sock { 151 struct sock sk; 152 int bound; 153 int ifindex; 154 canid_t txid; 155 canid_t rxid; 156 ktime_t tx_gap; 157 ktime_t lastrxcf_tstamp; 158 struct hrtimer rxtimer, txtimer, txfrtimer; 159 struct can_isotp_options opt; 160 struct can_isotp_fc_options rxfc, txfc; 161 struct can_isotp_ll_options ll; 162 u32 frame_txtime; 163 u32 force_tx_stmin; 164 u32 force_rx_stmin; 165 u32 cfecho; /* consecutive frame echo tag */ 166 struct tpcon rx, tx; 167 struct list_head notifier; 168 wait_queue_head_t wait; 169 spinlock_t rx_lock; /* protect single thread state machine */ 170 }; 171 172 static LIST_HEAD(isotp_notifier_list); 173 static DEFINE_SPINLOCK(isotp_notifier_lock); 174 static struct isotp_sock *isotp_busy_notifier; 175 176 static inline struct isotp_sock *isotp_sk(const struct sock *sk) 177 { 178 return (struct isotp_sock *)sk; 179 } 180 181 static u32 isotp_bc_flags(struct isotp_sock *so) 182 { 183 return so->opt.flags & ISOTP_ALL_BC_FLAGS; 184 } 185 186 static bool isotp_register_rxid(struct isotp_sock *so) 187 { 188 /* no broadcast modes => register rx_id for FC frame reception */ 189 return (isotp_bc_flags(so) == 0); 190 } 191 192 static enum hrtimer_restart isotp_rx_timer_handler(struct hrtimer *hrtimer) 193 { 194 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 195 rxtimer); 196 struct sock *sk = &so->sk; 197 198 if (so->rx.state == ISOTP_WAIT_DATA) { 199 /* we did not get new data frames in time */ 200 201 /* report 'connection timed out' */ 202 sk->sk_err = ETIMEDOUT; 203 if (!sock_flag(sk, SOCK_DEAD)) 204 sk_error_report(sk); 205 206 /* reset rx state */ 207 so->rx.state = ISOTP_IDLE; 208 } 209 210 return HRTIMER_NORESTART; 211 } 212 213 static int isotp_send_fc(struct sock *sk, int ae, u8 flowstatus) 214 { 215 struct net_device *dev; 216 struct sk_buff *nskb; 217 struct canfd_frame *ncf; 218 struct isotp_sock *so = isotp_sk(sk); 219 int can_send_ret; 220 221 nskb = alloc_skb(so->ll.mtu + sizeof(struct can_skb_priv), gfp_any()); 222 if (!nskb) 223 return 1; 224 225 dev = dev_get_by_index(sock_net(sk), so->ifindex); 226 if (!dev) { 227 kfree_skb(nskb); 228 return 1; 229 } 230 231 can_skb_reserve(nskb); 232 can_skb_prv(nskb)->ifindex = dev->ifindex; 233 can_skb_prv(nskb)->skbcnt = 0; 234 235 nskb->dev = dev; 236 can_skb_set_owner(nskb, sk); 237 ncf = (struct canfd_frame *)nskb->data; 238 skb_put_zero(nskb, so->ll.mtu); 239 240 /* create & send flow control reply */ 241 ncf->can_id = so->txid; 242 243 if (so->opt.flags & CAN_ISOTP_TX_PADDING) { 244 memset(ncf->data, so->opt.txpad_content, CAN_MAX_DLEN); 245 ncf->len = CAN_MAX_DLEN; 246 } else { 247 ncf->len = ae + FC_CONTENT_SZ; 248 } 249 250 ncf->data[ae] = N_PCI_FC | flowstatus; 251 ncf->data[ae + 1] = so->rxfc.bs; 252 ncf->data[ae + 2] = so->rxfc.stmin; 253 254 if (ae) 255 ncf->data[0] = so->opt.ext_address; 256 257 ncf->flags = so->ll.tx_flags; 258 259 can_send_ret = can_send(nskb, 1); 260 if (can_send_ret) 261 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 262 __func__, ERR_PTR(can_send_ret)); 263 264 dev_put(dev); 265 266 /* reset blocksize counter */ 267 so->rx.bs = 0; 268 269 /* reset last CF frame rx timestamp for rx stmin enforcement */ 270 so->lastrxcf_tstamp = ktime_set(0, 0); 271 272 /* start rx timeout watchdog */ 273 hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 274 HRTIMER_MODE_REL_SOFT); 275 return 0; 276 } 277 278 static void isotp_rcv_skb(struct sk_buff *skb, struct sock *sk) 279 { 280 struct sockaddr_can *addr = (struct sockaddr_can *)skb->cb; 281 282 BUILD_BUG_ON(sizeof(skb->cb) < sizeof(struct sockaddr_can)); 283 284 memset(addr, 0, sizeof(*addr)); 285 addr->can_family = AF_CAN; 286 addr->can_ifindex = skb->dev->ifindex; 287 288 if (sock_queue_rcv_skb(sk, skb) < 0) 289 kfree_skb(skb); 290 } 291 292 static u8 padlen(u8 datalen) 293 { 294 static const u8 plen[] = { 295 8, 8, 8, 8, 8, 8, 8, 8, 8, /* 0 - 8 */ 296 12, 12, 12, 12, /* 9 - 12 */ 297 16, 16, 16, 16, /* 13 - 16 */ 298 20, 20, 20, 20, /* 17 - 20 */ 299 24, 24, 24, 24, /* 21 - 24 */ 300 32, 32, 32, 32, 32, 32, 32, 32, /* 25 - 32 */ 301 48, 48, 48, 48, 48, 48, 48, 48, /* 33 - 40 */ 302 48, 48, 48, 48, 48, 48, 48, 48 /* 41 - 48 */ 303 }; 304 305 if (datalen > 48) 306 return 64; 307 308 return plen[datalen]; 309 } 310 311 /* check for length optimization and return 1/true when the check fails */ 312 static int check_optimized(struct canfd_frame *cf, int start_index) 313 { 314 /* for CAN_DL <= 8 the start_index is equal to the CAN_DL as the 315 * padding would start at this point. E.g. if the padding would 316 * start at cf.data[7] cf->len has to be 7 to be optimal. 317 * Note: The data[] index starts with zero. 318 */ 319 if (cf->len <= CAN_MAX_DLEN) 320 return (cf->len != start_index); 321 322 /* This relation is also valid in the non-linear DLC range, where 323 * we need to take care of the minimal next possible CAN_DL. 324 * The correct check would be (padlen(cf->len) != padlen(start_index)). 325 * But as cf->len can only take discrete values from 12, .., 64 at this 326 * point the padlen(cf->len) is always equal to cf->len. 327 */ 328 return (cf->len != padlen(start_index)); 329 } 330 331 /* check padding and return 1/true when the check fails */ 332 static int check_pad(struct isotp_sock *so, struct canfd_frame *cf, 333 int start_index, u8 content) 334 { 335 int i; 336 337 /* no RX_PADDING value => check length of optimized frame length */ 338 if (!(so->opt.flags & CAN_ISOTP_RX_PADDING)) { 339 if (so->opt.flags & CAN_ISOTP_CHK_PAD_LEN) 340 return check_optimized(cf, start_index); 341 342 /* no valid test against empty value => ignore frame */ 343 return 1; 344 } 345 346 /* check datalength of correctly padded CAN frame */ 347 if ((so->opt.flags & CAN_ISOTP_CHK_PAD_LEN) && 348 cf->len != padlen(cf->len)) 349 return 1; 350 351 /* check padding content */ 352 if (so->opt.flags & CAN_ISOTP_CHK_PAD_DATA) { 353 for (i = start_index; i < cf->len; i++) 354 if (cf->data[i] != content) 355 return 1; 356 } 357 return 0; 358 } 359 360 static void isotp_send_cframe(struct isotp_sock *so); 361 362 static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) 363 { 364 struct sock *sk = &so->sk; 365 366 if (so->tx.state != ISOTP_WAIT_FC && 367 so->tx.state != ISOTP_WAIT_FIRST_FC) 368 return 0; 369 370 hrtimer_cancel(&so->txtimer); 371 372 if ((cf->len < ae + FC_CONTENT_SZ) || 373 ((so->opt.flags & ISOTP_CHECK_PADDING) && 374 check_pad(so, cf, ae + FC_CONTENT_SZ, so->opt.rxpad_content))) { 375 /* malformed PDU - report 'not a data message' */ 376 sk->sk_err = EBADMSG; 377 if (!sock_flag(sk, SOCK_DEAD)) 378 sk_error_report(sk); 379 380 so->tx.state = ISOTP_IDLE; 381 wake_up_interruptible(&so->wait); 382 return 1; 383 } 384 385 /* get static/dynamic communication params from first/every FC frame */ 386 if (so->tx.state == ISOTP_WAIT_FIRST_FC || 387 so->opt.flags & CAN_ISOTP_DYN_FC_PARMS) { 388 so->txfc.bs = cf->data[ae + 1]; 389 so->txfc.stmin = cf->data[ae + 2]; 390 391 /* fix wrong STmin values according spec */ 392 if (so->txfc.stmin > 0x7F && 393 (so->txfc.stmin < 0xF1 || so->txfc.stmin > 0xF9)) 394 so->txfc.stmin = 0x7F; 395 396 so->tx_gap = ktime_set(0, 0); 397 /* add transmission time for CAN frame N_As */ 398 so->tx_gap = ktime_add_ns(so->tx_gap, so->frame_txtime); 399 /* add waiting time for consecutive frames N_Cs */ 400 if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) 401 so->tx_gap = ktime_add_ns(so->tx_gap, 402 so->force_tx_stmin); 403 else if (so->txfc.stmin < 0x80) 404 so->tx_gap = ktime_add_ns(so->tx_gap, 405 so->txfc.stmin * 1000000); 406 else 407 so->tx_gap = ktime_add_ns(so->tx_gap, 408 (so->txfc.stmin - 0xF0) 409 * 100000); 410 so->tx.state = ISOTP_WAIT_FC; 411 } 412 413 switch (cf->data[ae] & 0x0F) { 414 case ISOTP_FC_CTS: 415 so->tx.bs = 0; 416 so->tx.state = ISOTP_SENDING; 417 /* send CF frame and enable echo timeout handling */ 418 hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 419 HRTIMER_MODE_REL_SOFT); 420 isotp_send_cframe(so); 421 break; 422 423 case ISOTP_FC_WT: 424 /* start timer to wait for next FC frame */ 425 hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 426 HRTIMER_MODE_REL_SOFT); 427 break; 428 429 case ISOTP_FC_OVFLW: 430 /* overflow on receiver side - report 'message too long' */ 431 sk->sk_err = EMSGSIZE; 432 if (!sock_flag(sk, SOCK_DEAD)) 433 sk_error_report(sk); 434 fallthrough; 435 436 default: 437 /* stop this tx job */ 438 so->tx.state = ISOTP_IDLE; 439 wake_up_interruptible(&so->wait); 440 } 441 return 0; 442 } 443 444 static int isotp_rcv_sf(struct sock *sk, struct canfd_frame *cf, int pcilen, 445 struct sk_buff *skb, int len) 446 { 447 struct isotp_sock *so = isotp_sk(sk); 448 struct sk_buff *nskb; 449 450 hrtimer_cancel(&so->rxtimer); 451 so->rx.state = ISOTP_IDLE; 452 453 if (!len || len > cf->len - pcilen) 454 return 1; 455 456 if ((so->opt.flags & ISOTP_CHECK_PADDING) && 457 check_pad(so, cf, pcilen + len, so->opt.rxpad_content)) { 458 /* malformed PDU - report 'not a data message' */ 459 sk->sk_err = EBADMSG; 460 if (!sock_flag(sk, SOCK_DEAD)) 461 sk_error_report(sk); 462 return 1; 463 } 464 465 nskb = alloc_skb(len, gfp_any()); 466 if (!nskb) 467 return 1; 468 469 memcpy(skb_put(nskb, len), &cf->data[pcilen], len); 470 471 nskb->tstamp = skb->tstamp; 472 nskb->dev = skb->dev; 473 isotp_rcv_skb(nskb, sk); 474 return 0; 475 } 476 477 static int isotp_rcv_ff(struct sock *sk, struct canfd_frame *cf, int ae) 478 { 479 struct isotp_sock *so = isotp_sk(sk); 480 int i; 481 int off; 482 int ff_pci_sz; 483 484 hrtimer_cancel(&so->rxtimer); 485 so->rx.state = ISOTP_IDLE; 486 487 /* get the used sender LL_DL from the (first) CAN frame data length */ 488 so->rx.ll_dl = padlen(cf->len); 489 490 /* the first frame has to use the entire frame up to LL_DL length */ 491 if (cf->len != so->rx.ll_dl) 492 return 1; 493 494 /* get the FF_DL */ 495 so->rx.len = (cf->data[ae] & 0x0F) << 8; 496 so->rx.len += cf->data[ae + 1]; 497 498 /* Check for FF_DL escape sequence supporting 32 bit PDU length */ 499 if (so->rx.len) { 500 ff_pci_sz = FF_PCI_SZ12; 501 } else { 502 /* FF_DL = 0 => get real length from next 4 bytes */ 503 so->rx.len = cf->data[ae + 2] << 24; 504 so->rx.len += cf->data[ae + 3] << 16; 505 so->rx.len += cf->data[ae + 4] << 8; 506 so->rx.len += cf->data[ae + 5]; 507 ff_pci_sz = FF_PCI_SZ32; 508 } 509 510 /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ 511 off = (so->rx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; 512 513 if (so->rx.len + ae + off + ff_pci_sz < so->rx.ll_dl) 514 return 1; 515 516 /* PDU size > default => try max_pdu_size */ 517 if (so->rx.len > so->rx.buflen && so->rx.buflen < max_pdu_size) { 518 u8 *newbuf = kmalloc(max_pdu_size, GFP_ATOMIC); 519 520 if (newbuf) { 521 so->rx.buf = newbuf; 522 so->rx.buflen = max_pdu_size; 523 } 524 } 525 526 if (so->rx.len > so->rx.buflen) { 527 /* send FC frame with overflow status */ 528 isotp_send_fc(sk, ae, ISOTP_FC_OVFLW); 529 return 1; 530 } 531 532 /* copy the first received data bytes */ 533 so->rx.idx = 0; 534 for (i = ae + ff_pci_sz; i < so->rx.ll_dl; i++) 535 so->rx.buf[so->rx.idx++] = cf->data[i]; 536 537 /* initial setup for this pdu reception */ 538 so->rx.sn = 1; 539 so->rx.state = ISOTP_WAIT_DATA; 540 541 /* no creation of flow control frames */ 542 if (so->opt.flags & CAN_ISOTP_LISTEN_MODE) 543 return 0; 544 545 /* send our first FC frame */ 546 isotp_send_fc(sk, ae, ISOTP_FC_CTS); 547 return 0; 548 } 549 550 static int isotp_rcv_cf(struct sock *sk, struct canfd_frame *cf, int ae, 551 struct sk_buff *skb) 552 { 553 struct isotp_sock *so = isotp_sk(sk); 554 struct sk_buff *nskb; 555 int i; 556 557 if (so->rx.state != ISOTP_WAIT_DATA) 558 return 0; 559 560 /* drop if timestamp gap is less than force_rx_stmin nano secs */ 561 if (so->opt.flags & CAN_ISOTP_FORCE_RXSTMIN) { 562 if (ktime_to_ns(ktime_sub(skb->tstamp, so->lastrxcf_tstamp)) < 563 so->force_rx_stmin) 564 return 0; 565 566 so->lastrxcf_tstamp = skb->tstamp; 567 } 568 569 hrtimer_cancel(&so->rxtimer); 570 571 /* CFs are never longer than the FF */ 572 if (cf->len > so->rx.ll_dl) 573 return 1; 574 575 /* CFs have usually the LL_DL length */ 576 if (cf->len < so->rx.ll_dl) { 577 /* this is only allowed for the last CF */ 578 if (so->rx.len - so->rx.idx > so->rx.ll_dl - ae - N_PCI_SZ) 579 return 1; 580 } 581 582 if ((cf->data[ae] & 0x0F) != so->rx.sn) { 583 /* wrong sn detected - report 'illegal byte sequence' */ 584 sk->sk_err = EILSEQ; 585 if (!sock_flag(sk, SOCK_DEAD)) 586 sk_error_report(sk); 587 588 /* reset rx state */ 589 so->rx.state = ISOTP_IDLE; 590 return 1; 591 } 592 so->rx.sn++; 593 so->rx.sn %= 16; 594 595 for (i = ae + N_PCI_SZ; i < cf->len; i++) { 596 so->rx.buf[so->rx.idx++] = cf->data[i]; 597 if (so->rx.idx >= so->rx.len) 598 break; 599 } 600 601 if (so->rx.idx >= so->rx.len) { 602 /* we are done */ 603 so->rx.state = ISOTP_IDLE; 604 605 if ((so->opt.flags & ISOTP_CHECK_PADDING) && 606 check_pad(so, cf, i + 1, so->opt.rxpad_content)) { 607 /* malformed PDU - report 'not a data message' */ 608 sk->sk_err = EBADMSG; 609 if (!sock_flag(sk, SOCK_DEAD)) 610 sk_error_report(sk); 611 return 1; 612 } 613 614 nskb = alloc_skb(so->rx.len, gfp_any()); 615 if (!nskb) 616 return 1; 617 618 memcpy(skb_put(nskb, so->rx.len), so->rx.buf, 619 so->rx.len); 620 621 nskb->tstamp = skb->tstamp; 622 nskb->dev = skb->dev; 623 isotp_rcv_skb(nskb, sk); 624 return 0; 625 } 626 627 /* perform blocksize handling, if enabled */ 628 if (!so->rxfc.bs || ++so->rx.bs < so->rxfc.bs) { 629 /* start rx timeout watchdog */ 630 hrtimer_start(&so->rxtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 631 HRTIMER_MODE_REL_SOFT); 632 return 0; 633 } 634 635 /* no creation of flow control frames */ 636 if (so->opt.flags & CAN_ISOTP_LISTEN_MODE) 637 return 0; 638 639 /* we reached the specified blocksize so->rxfc.bs */ 640 isotp_send_fc(sk, ae, ISOTP_FC_CTS); 641 return 0; 642 } 643 644 static void isotp_rcv(struct sk_buff *skb, void *data) 645 { 646 struct sock *sk = (struct sock *)data; 647 struct isotp_sock *so = isotp_sk(sk); 648 struct canfd_frame *cf; 649 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 650 u8 n_pci_type, sf_dl; 651 652 /* Strictly receive only frames with the configured MTU size 653 * => clear separation of CAN2.0 / CAN FD transport channels 654 */ 655 if (skb->len != so->ll.mtu) 656 return; 657 658 cf = (struct canfd_frame *)skb->data; 659 660 /* if enabled: check reception of my configured extended address */ 661 if (ae && cf->data[0] != so->opt.rx_ext_address) 662 return; 663 664 n_pci_type = cf->data[ae] & 0xF0; 665 666 /* Make sure the state changes and data structures stay consistent at 667 * CAN frame reception time. This locking is not needed in real world 668 * use cases but the inconsistency can be triggered with syzkaller. 669 */ 670 spin_lock(&so->rx_lock); 671 672 if (so->opt.flags & CAN_ISOTP_HALF_DUPLEX) { 673 /* check rx/tx path half duplex expectations */ 674 if ((so->tx.state != ISOTP_IDLE && n_pci_type != N_PCI_FC) || 675 (so->rx.state != ISOTP_IDLE && n_pci_type == N_PCI_FC)) 676 goto out_unlock; 677 } 678 679 switch (n_pci_type) { 680 case N_PCI_FC: 681 /* tx path: flow control frame containing the FC parameters */ 682 isotp_rcv_fc(so, cf, ae); 683 break; 684 685 case N_PCI_SF: 686 /* rx path: single frame 687 * 688 * As we do not have a rx.ll_dl configuration, we can only test 689 * if the CAN frames payload length matches the LL_DL == 8 690 * requirements - no matter if it's CAN 2.0 or CAN FD 691 */ 692 693 /* get the SF_DL from the N_PCI byte */ 694 sf_dl = cf->data[ae] & 0x0F; 695 696 if (cf->len <= CAN_MAX_DLEN) { 697 isotp_rcv_sf(sk, cf, SF_PCI_SZ4 + ae, skb, sf_dl); 698 } else { 699 if (can_is_canfd_skb(skb)) { 700 /* We have a CAN FD frame and CAN_DL is greater than 8: 701 * Only frames with the SF_DL == 0 ESC value are valid. 702 * 703 * If so take care of the increased SF PCI size 704 * (SF_PCI_SZ8) to point to the message content behind 705 * the extended SF PCI info and get the real SF_DL 706 * length value from the formerly first data byte. 707 */ 708 if (sf_dl == 0) 709 isotp_rcv_sf(sk, cf, SF_PCI_SZ8 + ae, skb, 710 cf->data[SF_PCI_SZ4 + ae]); 711 } 712 } 713 break; 714 715 case N_PCI_FF: 716 /* rx path: first frame */ 717 isotp_rcv_ff(sk, cf, ae); 718 break; 719 720 case N_PCI_CF: 721 /* rx path: consecutive frame */ 722 isotp_rcv_cf(sk, cf, ae, skb); 723 break; 724 } 725 726 out_unlock: 727 spin_unlock(&so->rx_lock); 728 } 729 730 static void isotp_fill_dataframe(struct canfd_frame *cf, struct isotp_sock *so, 731 int ae, int off) 732 { 733 int pcilen = N_PCI_SZ + ae + off; 734 int space = so->tx.ll_dl - pcilen; 735 int num = min_t(int, so->tx.len - so->tx.idx, space); 736 int i; 737 738 cf->can_id = so->txid; 739 cf->len = num + pcilen; 740 741 if (num < space) { 742 if (so->opt.flags & CAN_ISOTP_TX_PADDING) { 743 /* user requested padding */ 744 cf->len = padlen(cf->len); 745 memset(cf->data, so->opt.txpad_content, cf->len); 746 } else if (cf->len > CAN_MAX_DLEN) { 747 /* mandatory padding for CAN FD frames */ 748 cf->len = padlen(cf->len); 749 memset(cf->data, CAN_ISOTP_DEFAULT_PAD_CONTENT, 750 cf->len); 751 } 752 } 753 754 for (i = 0; i < num; i++) 755 cf->data[pcilen + i] = so->tx.buf[so->tx.idx++]; 756 757 if (ae) 758 cf->data[0] = so->opt.ext_address; 759 } 760 761 static void isotp_send_cframe(struct isotp_sock *so) 762 { 763 struct sock *sk = &so->sk; 764 struct sk_buff *skb; 765 struct net_device *dev; 766 struct canfd_frame *cf; 767 int can_send_ret; 768 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 769 770 dev = dev_get_by_index(sock_net(sk), so->ifindex); 771 if (!dev) 772 return; 773 774 skb = alloc_skb(so->ll.mtu + sizeof(struct can_skb_priv), GFP_ATOMIC); 775 if (!skb) { 776 dev_put(dev); 777 return; 778 } 779 780 can_skb_reserve(skb); 781 can_skb_prv(skb)->ifindex = dev->ifindex; 782 can_skb_prv(skb)->skbcnt = 0; 783 784 cf = (struct canfd_frame *)skb->data; 785 skb_put_zero(skb, so->ll.mtu); 786 787 /* create consecutive frame */ 788 isotp_fill_dataframe(cf, so, ae, 0); 789 790 /* place consecutive frame N_PCI in appropriate index */ 791 cf->data[ae] = N_PCI_CF | so->tx.sn++; 792 so->tx.sn %= 16; 793 so->tx.bs++; 794 795 cf->flags = so->ll.tx_flags; 796 797 skb->dev = dev; 798 can_skb_set_owner(skb, sk); 799 800 /* cfecho should have been zero'ed by init/isotp_rcv_echo() */ 801 if (so->cfecho) 802 pr_notice_once("can-isotp: cfecho is %08X != 0\n", so->cfecho); 803 804 /* set consecutive frame echo tag */ 805 so->cfecho = *(u32 *)cf->data; 806 807 /* send frame with local echo enabled */ 808 can_send_ret = can_send(skb, 1); 809 if (can_send_ret) { 810 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 811 __func__, ERR_PTR(can_send_ret)); 812 if (can_send_ret == -ENOBUFS) 813 pr_notice_once("can-isotp: tx queue is full\n"); 814 } 815 dev_put(dev); 816 } 817 818 static void isotp_create_fframe(struct canfd_frame *cf, struct isotp_sock *so, 819 int ae) 820 { 821 int i; 822 int ff_pci_sz; 823 824 cf->can_id = so->txid; 825 cf->len = so->tx.ll_dl; 826 if (ae) 827 cf->data[0] = so->opt.ext_address; 828 829 /* create N_PCI bytes with 12/32 bit FF_DL data length */ 830 if (so->tx.len > MAX_12BIT_PDU_SIZE) { 831 /* use 32 bit FF_DL notation */ 832 cf->data[ae] = N_PCI_FF; 833 cf->data[ae + 1] = 0; 834 cf->data[ae + 2] = (u8)(so->tx.len >> 24) & 0xFFU; 835 cf->data[ae + 3] = (u8)(so->tx.len >> 16) & 0xFFU; 836 cf->data[ae + 4] = (u8)(so->tx.len >> 8) & 0xFFU; 837 cf->data[ae + 5] = (u8)so->tx.len & 0xFFU; 838 ff_pci_sz = FF_PCI_SZ32; 839 } else { 840 /* use 12 bit FF_DL notation */ 841 cf->data[ae] = (u8)(so->tx.len >> 8) | N_PCI_FF; 842 cf->data[ae + 1] = (u8)so->tx.len & 0xFFU; 843 ff_pci_sz = FF_PCI_SZ12; 844 } 845 846 /* add first data bytes depending on ae */ 847 for (i = ae + ff_pci_sz; i < so->tx.ll_dl; i++) 848 cf->data[i] = so->tx.buf[so->tx.idx++]; 849 850 so->tx.sn = 1; 851 } 852 853 static void isotp_rcv_echo(struct sk_buff *skb, void *data) 854 { 855 struct sock *sk = (struct sock *)data; 856 struct isotp_sock *so = isotp_sk(sk); 857 struct canfd_frame *cf = (struct canfd_frame *)skb->data; 858 859 /* only handle my own local echo CF/SF skb's (no FF!) */ 860 if (skb->sk != sk || so->cfecho != *(u32 *)cf->data) 861 return; 862 863 /* cancel local echo timeout */ 864 hrtimer_cancel(&so->txtimer); 865 866 /* local echo skb with consecutive frame has been consumed */ 867 so->cfecho = 0; 868 869 if (so->tx.idx >= so->tx.len) { 870 /* we are done */ 871 so->tx.state = ISOTP_IDLE; 872 wake_up_interruptible(&so->wait); 873 return; 874 } 875 876 if (so->txfc.bs && so->tx.bs >= so->txfc.bs) { 877 /* stop and wait for FC with timeout */ 878 so->tx.state = ISOTP_WAIT_FC; 879 hrtimer_start(&so->txtimer, ktime_set(ISOTP_FC_TIMEOUT, 0), 880 HRTIMER_MODE_REL_SOFT); 881 return; 882 } 883 884 /* no gap between data frames needed => use burst mode */ 885 if (!so->tx_gap) { 886 /* enable echo timeout handling */ 887 hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 888 HRTIMER_MODE_REL_SOFT); 889 isotp_send_cframe(so); 890 return; 891 } 892 893 /* start timer to send next consecutive frame with correct delay */ 894 hrtimer_start(&so->txfrtimer, so->tx_gap, HRTIMER_MODE_REL_SOFT); 895 } 896 897 static enum hrtimer_restart isotp_tx_timer_handler(struct hrtimer *hrtimer) 898 { 899 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 900 txtimer); 901 struct sock *sk = &so->sk; 902 903 /* don't handle timeouts in IDLE or SHUTDOWN state */ 904 if (so->tx.state == ISOTP_IDLE || so->tx.state == ISOTP_SHUTDOWN) 905 return HRTIMER_NORESTART; 906 907 /* we did not get any flow control or echo frame in time */ 908 909 /* report 'communication error on send' */ 910 sk->sk_err = ECOMM; 911 if (!sock_flag(sk, SOCK_DEAD)) 912 sk_error_report(sk); 913 914 /* reset tx state */ 915 so->tx.state = ISOTP_IDLE; 916 wake_up_interruptible(&so->wait); 917 918 return HRTIMER_NORESTART; 919 } 920 921 static enum hrtimer_restart isotp_txfr_timer_handler(struct hrtimer *hrtimer) 922 { 923 struct isotp_sock *so = container_of(hrtimer, struct isotp_sock, 924 txfrtimer); 925 926 /* start echo timeout handling and cover below protocol error */ 927 hrtimer_start(&so->txtimer, ktime_set(ISOTP_ECHO_TIMEOUT, 0), 928 HRTIMER_MODE_REL_SOFT); 929 930 /* cfecho should be consumed by isotp_rcv_echo() here */ 931 if (so->tx.state == ISOTP_SENDING && !so->cfecho) 932 isotp_send_cframe(so); 933 934 return HRTIMER_NORESTART; 935 } 936 937 static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) 938 { 939 struct sock *sk = sock->sk; 940 struct isotp_sock *so = isotp_sk(sk); 941 struct sk_buff *skb; 942 struct net_device *dev; 943 struct canfd_frame *cf; 944 int ae = (so->opt.flags & CAN_ISOTP_EXTEND_ADDR) ? 1 : 0; 945 int wait_tx_done = (so->opt.flags & CAN_ISOTP_WAIT_TX_DONE) ? 1 : 0; 946 s64 hrtimer_sec = ISOTP_ECHO_TIMEOUT; 947 int off; 948 int err; 949 950 if (!so->bound || so->tx.state == ISOTP_SHUTDOWN) 951 return -EADDRNOTAVAIL; 952 953 while (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE) { 954 /* we do not support multiple buffers - for now */ 955 if (msg->msg_flags & MSG_DONTWAIT) 956 return -EAGAIN; 957 958 if (so->tx.state == ISOTP_SHUTDOWN) 959 return -EADDRNOTAVAIL; 960 961 /* wait for complete transmission of current pdu */ 962 err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); 963 if (err) 964 goto err_event_drop; 965 } 966 967 /* PDU size > default => try max_pdu_size */ 968 if (size > so->tx.buflen && so->tx.buflen < max_pdu_size) { 969 u8 *newbuf = kmalloc(max_pdu_size, GFP_KERNEL); 970 971 if (newbuf) { 972 so->tx.buf = newbuf; 973 so->tx.buflen = max_pdu_size; 974 } 975 } 976 977 if (!size || size > so->tx.buflen) { 978 err = -EINVAL; 979 goto err_out_drop; 980 } 981 982 /* take care of a potential SF_DL ESC offset for TX_DL > 8 */ 983 off = (so->tx.ll_dl > CAN_MAX_DLEN) ? 1 : 0; 984 985 /* does the given data fit into a single frame for SF_BROADCAST? */ 986 if ((isotp_bc_flags(so) == CAN_ISOTP_SF_BROADCAST) && 987 (size > so->tx.ll_dl - SF_PCI_SZ4 - ae - off)) { 988 err = -EINVAL; 989 goto err_out_drop; 990 } 991 992 err = memcpy_from_msg(so->tx.buf, msg, size); 993 if (err < 0) 994 goto err_out_drop; 995 996 dev = dev_get_by_index(sock_net(sk), so->ifindex); 997 if (!dev) { 998 err = -ENXIO; 999 goto err_out_drop; 1000 } 1001 1002 skb = sock_alloc_send_skb(sk, so->ll.mtu + sizeof(struct can_skb_priv), 1003 msg->msg_flags & MSG_DONTWAIT, &err); 1004 if (!skb) { 1005 dev_put(dev); 1006 goto err_out_drop; 1007 } 1008 1009 can_skb_reserve(skb); 1010 can_skb_prv(skb)->ifindex = dev->ifindex; 1011 can_skb_prv(skb)->skbcnt = 0; 1012 1013 so->tx.len = size; 1014 so->tx.idx = 0; 1015 1016 cf = (struct canfd_frame *)skb->data; 1017 skb_put_zero(skb, so->ll.mtu); 1018 1019 /* cfecho should have been zero'ed by init / former isotp_rcv_echo() */ 1020 if (so->cfecho) 1021 pr_notice_once("can-isotp: uninit cfecho %08X\n", so->cfecho); 1022 1023 /* check for single frame transmission depending on TX_DL */ 1024 if (size <= so->tx.ll_dl - SF_PCI_SZ4 - ae - off) { 1025 /* The message size generally fits into a SingleFrame - good. 1026 * 1027 * SF_DL ESC offset optimization: 1028 * 1029 * When TX_DL is greater 8 but the message would still fit 1030 * into a 8 byte CAN frame, we can omit the offset. 1031 * This prevents a protocol caused length extension from 1032 * CAN_DL = 8 to CAN_DL = 12 due to the SF_SL ESC handling. 1033 */ 1034 if (size <= CAN_MAX_DLEN - SF_PCI_SZ4 - ae) 1035 off = 0; 1036 1037 isotp_fill_dataframe(cf, so, ae, off); 1038 1039 /* place single frame N_PCI w/o length in appropriate index */ 1040 cf->data[ae] = N_PCI_SF; 1041 1042 /* place SF_DL size value depending on the SF_DL ESC offset */ 1043 if (off) 1044 cf->data[SF_PCI_SZ4 + ae] = size; 1045 else 1046 cf->data[ae] |= size; 1047 1048 /* set CF echo tag for isotp_rcv_echo() (SF-mode) */ 1049 so->cfecho = *(u32 *)cf->data; 1050 } else { 1051 /* send first frame */ 1052 1053 isotp_create_fframe(cf, so, ae); 1054 1055 if (isotp_bc_flags(so) == CAN_ISOTP_CF_BROADCAST) { 1056 /* set timer for FC-less operation (STmin = 0) */ 1057 if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) 1058 so->tx_gap = ktime_set(0, so->force_tx_stmin); 1059 else 1060 so->tx_gap = ktime_set(0, so->frame_txtime); 1061 1062 /* disable wait for FCs due to activated block size */ 1063 so->txfc.bs = 0; 1064 1065 /* set CF echo tag for isotp_rcv_echo() (CF-mode) */ 1066 so->cfecho = *(u32 *)cf->data; 1067 } else { 1068 /* standard flow control check */ 1069 so->tx.state = ISOTP_WAIT_FIRST_FC; 1070 1071 /* start timeout for FC */ 1072 hrtimer_sec = ISOTP_FC_TIMEOUT; 1073 1074 /* no CF echo tag for isotp_rcv_echo() (FF-mode) */ 1075 so->cfecho = 0; 1076 } 1077 } 1078 1079 hrtimer_start(&so->txtimer, ktime_set(hrtimer_sec, 0), 1080 HRTIMER_MODE_REL_SOFT); 1081 1082 /* send the first or only CAN frame */ 1083 cf->flags = so->ll.tx_flags; 1084 1085 skb->dev = dev; 1086 skb->sk = sk; 1087 err = can_send(skb, 1); 1088 dev_put(dev); 1089 if (err) { 1090 pr_notice_once("can-isotp: %s: can_send_ret %pe\n", 1091 __func__, ERR_PTR(err)); 1092 1093 /* no transmission -> no timeout monitoring */ 1094 hrtimer_cancel(&so->txtimer); 1095 1096 /* reset consecutive frame echo tag */ 1097 so->cfecho = 0; 1098 1099 goto err_out_drop; 1100 } 1101 1102 if (wait_tx_done) { 1103 /* wait for complete transmission of current pdu */ 1104 err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE); 1105 if (err) 1106 goto err_event_drop; 1107 1108 err = sock_error(sk); 1109 if (err) 1110 return err; 1111 } 1112 1113 return size; 1114 1115 err_event_drop: 1116 /* got signal: force tx state machine to be idle */ 1117 so->tx.state = ISOTP_IDLE; 1118 hrtimer_cancel(&so->txfrtimer); 1119 hrtimer_cancel(&so->txtimer); 1120 err_out_drop: 1121 /* drop this PDU and unlock a potential wait queue */ 1122 so->tx.state = ISOTP_IDLE; 1123 wake_up_interruptible(&so->wait); 1124 1125 return err; 1126 } 1127 1128 static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, 1129 int flags) 1130 { 1131 struct sock *sk = sock->sk; 1132 struct sk_buff *skb; 1133 struct isotp_sock *so = isotp_sk(sk); 1134 int ret = 0; 1135 1136 if (flags & ~(MSG_DONTWAIT | MSG_TRUNC | MSG_PEEK | MSG_CMSG_COMPAT)) 1137 return -EINVAL; 1138 1139 if (!so->bound) 1140 return -EADDRNOTAVAIL; 1141 1142 skb = skb_recv_datagram(sk, flags, &ret); 1143 if (!skb) 1144 return ret; 1145 1146 if (size < skb->len) 1147 msg->msg_flags |= MSG_TRUNC; 1148 else 1149 size = skb->len; 1150 1151 ret = memcpy_to_msg(msg, skb->data, size); 1152 if (ret < 0) 1153 goto out_err; 1154 1155 sock_recv_cmsgs(msg, sk, skb); 1156 1157 if (msg->msg_name) { 1158 __sockaddr_check_size(ISOTP_MIN_NAMELEN); 1159 msg->msg_namelen = ISOTP_MIN_NAMELEN; 1160 memcpy(msg->msg_name, skb->cb, msg->msg_namelen); 1161 } 1162 1163 /* set length of return value */ 1164 ret = (flags & MSG_TRUNC) ? skb->len : size; 1165 1166 out_err: 1167 skb_free_datagram(sk, skb); 1168 1169 return ret; 1170 } 1171 1172 static int isotp_release(struct socket *sock) 1173 { 1174 struct sock *sk = sock->sk; 1175 struct isotp_sock *so; 1176 struct net *net; 1177 1178 if (!sk) 1179 return 0; 1180 1181 so = isotp_sk(sk); 1182 net = sock_net(sk); 1183 1184 /* wait for complete transmission of current pdu */ 1185 while (wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE) == 0 && 1186 cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SHUTDOWN) != ISOTP_IDLE) 1187 ; 1188 1189 /* force state machines to be idle also when a signal occurred */ 1190 so->tx.state = ISOTP_SHUTDOWN; 1191 so->rx.state = ISOTP_IDLE; 1192 1193 spin_lock(&isotp_notifier_lock); 1194 while (isotp_busy_notifier == so) { 1195 spin_unlock(&isotp_notifier_lock); 1196 schedule_timeout_uninterruptible(1); 1197 spin_lock(&isotp_notifier_lock); 1198 } 1199 list_del(&so->notifier); 1200 spin_unlock(&isotp_notifier_lock); 1201 1202 lock_sock(sk); 1203 1204 /* remove current filters & unregister */ 1205 if (so->bound) { 1206 if (so->ifindex) { 1207 struct net_device *dev; 1208 1209 dev = dev_get_by_index(net, so->ifindex); 1210 if (dev) { 1211 if (isotp_register_rxid(so)) 1212 can_rx_unregister(net, dev, so->rxid, 1213 SINGLE_MASK(so->rxid), 1214 isotp_rcv, sk); 1215 1216 can_rx_unregister(net, dev, so->txid, 1217 SINGLE_MASK(so->txid), 1218 isotp_rcv_echo, sk); 1219 dev_put(dev); 1220 synchronize_rcu(); 1221 } 1222 } 1223 } 1224 1225 hrtimer_cancel(&so->txfrtimer); 1226 hrtimer_cancel(&so->txtimer); 1227 hrtimer_cancel(&so->rxtimer); 1228 1229 so->ifindex = 0; 1230 so->bound = 0; 1231 1232 if (so->rx.buf != so->rx.sbuf) 1233 kfree(so->rx.buf); 1234 1235 if (so->tx.buf != so->tx.sbuf) 1236 kfree(so->tx.buf); 1237 1238 sock_orphan(sk); 1239 sock->sk = NULL; 1240 1241 release_sock(sk); 1242 sock_put(sk); 1243 1244 return 0; 1245 } 1246 1247 static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) 1248 { 1249 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 1250 struct sock *sk = sock->sk; 1251 struct isotp_sock *so = isotp_sk(sk); 1252 struct net *net = sock_net(sk); 1253 int ifindex; 1254 struct net_device *dev; 1255 canid_t tx_id = addr->can_addr.tp.tx_id; 1256 canid_t rx_id = addr->can_addr.tp.rx_id; 1257 int err = 0; 1258 int notify_enetdown = 0; 1259 1260 if (len < ISOTP_MIN_NAMELEN) 1261 return -EINVAL; 1262 1263 if (addr->can_family != AF_CAN) 1264 return -EINVAL; 1265 1266 /* sanitize tx CAN identifier */ 1267 if (tx_id & CAN_EFF_FLAG) 1268 tx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); 1269 else 1270 tx_id &= CAN_SFF_MASK; 1271 1272 /* give feedback on wrong CAN-ID value */ 1273 if (tx_id != addr->can_addr.tp.tx_id) 1274 return -EINVAL; 1275 1276 /* sanitize rx CAN identifier (if needed) */ 1277 if (isotp_register_rxid(so)) { 1278 if (rx_id & CAN_EFF_FLAG) 1279 rx_id &= (CAN_EFF_FLAG | CAN_EFF_MASK); 1280 else 1281 rx_id &= CAN_SFF_MASK; 1282 1283 /* give feedback on wrong CAN-ID value */ 1284 if (rx_id != addr->can_addr.tp.rx_id) 1285 return -EINVAL; 1286 } 1287 1288 if (!addr->can_ifindex) 1289 return -ENODEV; 1290 1291 lock_sock(sk); 1292 1293 if (so->bound) { 1294 err = -EINVAL; 1295 goto out; 1296 } 1297 1298 /* ensure different CAN IDs when the rx_id is to be registered */ 1299 if (isotp_register_rxid(so) && rx_id == tx_id) { 1300 err = -EADDRNOTAVAIL; 1301 goto out; 1302 } 1303 1304 dev = dev_get_by_index(net, addr->can_ifindex); 1305 if (!dev) { 1306 err = -ENODEV; 1307 goto out; 1308 } 1309 if (dev->type != ARPHRD_CAN) { 1310 dev_put(dev); 1311 err = -ENODEV; 1312 goto out; 1313 } 1314 if (dev->mtu < so->ll.mtu) { 1315 dev_put(dev); 1316 err = -EINVAL; 1317 goto out; 1318 } 1319 if (!(dev->flags & IFF_UP)) 1320 notify_enetdown = 1; 1321 1322 ifindex = dev->ifindex; 1323 1324 if (isotp_register_rxid(so)) 1325 can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id), 1326 isotp_rcv, sk, "isotp", sk); 1327 1328 /* no consecutive frame echo skb in flight */ 1329 so->cfecho = 0; 1330 1331 /* register for echo skb's */ 1332 can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id), 1333 isotp_rcv_echo, sk, "isotpe", sk); 1334 1335 dev_put(dev); 1336 1337 /* switch to new settings */ 1338 so->ifindex = ifindex; 1339 so->rxid = rx_id; 1340 so->txid = tx_id; 1341 so->bound = 1; 1342 1343 out: 1344 release_sock(sk); 1345 1346 if (notify_enetdown) { 1347 sk->sk_err = ENETDOWN; 1348 if (!sock_flag(sk, SOCK_DEAD)) 1349 sk_error_report(sk); 1350 } 1351 1352 return err; 1353 } 1354 1355 static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer) 1356 { 1357 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr; 1358 struct sock *sk = sock->sk; 1359 struct isotp_sock *so = isotp_sk(sk); 1360 1361 if (peer) 1362 return -EOPNOTSUPP; 1363 1364 memset(addr, 0, ISOTP_MIN_NAMELEN); 1365 addr->can_family = AF_CAN; 1366 addr->can_ifindex = so->ifindex; 1367 addr->can_addr.tp.rx_id = so->rxid; 1368 addr->can_addr.tp.tx_id = so->txid; 1369 1370 return ISOTP_MIN_NAMELEN; 1371 } 1372 1373 static int isotp_setsockopt_locked(struct socket *sock, int level, int optname, 1374 sockptr_t optval, unsigned int optlen) 1375 { 1376 struct sock *sk = sock->sk; 1377 struct isotp_sock *so = isotp_sk(sk); 1378 int ret = 0; 1379 1380 if (so->bound) 1381 return -EISCONN; 1382 1383 switch (optname) { 1384 case CAN_ISOTP_OPTS: 1385 if (optlen != sizeof(struct can_isotp_options)) 1386 return -EINVAL; 1387 1388 if (copy_from_sockptr(&so->opt, optval, optlen)) 1389 return -EFAULT; 1390 1391 /* no separate rx_ext_address is given => use ext_address */ 1392 if (!(so->opt.flags & CAN_ISOTP_RX_EXT_ADDR)) 1393 so->opt.rx_ext_address = so->opt.ext_address; 1394 1395 /* these broadcast flags are not allowed together */ 1396 if (isotp_bc_flags(so) == ISOTP_ALL_BC_FLAGS) { 1397 /* CAN_ISOTP_SF_BROADCAST is prioritized */ 1398 so->opt.flags &= ~CAN_ISOTP_CF_BROADCAST; 1399 1400 /* give user feedback on wrong config attempt */ 1401 ret = -EINVAL; 1402 } 1403 1404 /* check for frame_txtime changes (0 => no changes) */ 1405 if (so->opt.frame_txtime) { 1406 if (so->opt.frame_txtime == CAN_ISOTP_FRAME_TXTIME_ZERO) 1407 so->frame_txtime = 0; 1408 else 1409 so->frame_txtime = so->opt.frame_txtime; 1410 } 1411 break; 1412 1413 case CAN_ISOTP_RECV_FC: 1414 if (optlen != sizeof(struct can_isotp_fc_options)) 1415 return -EINVAL; 1416 1417 if (copy_from_sockptr(&so->rxfc, optval, optlen)) 1418 return -EFAULT; 1419 break; 1420 1421 case CAN_ISOTP_TX_STMIN: 1422 if (optlen != sizeof(u32)) 1423 return -EINVAL; 1424 1425 if (copy_from_sockptr(&so->force_tx_stmin, optval, optlen)) 1426 return -EFAULT; 1427 break; 1428 1429 case CAN_ISOTP_RX_STMIN: 1430 if (optlen != sizeof(u32)) 1431 return -EINVAL; 1432 1433 if (copy_from_sockptr(&so->force_rx_stmin, optval, optlen)) 1434 return -EFAULT; 1435 break; 1436 1437 case CAN_ISOTP_LL_OPTS: 1438 if (optlen == sizeof(struct can_isotp_ll_options)) { 1439 struct can_isotp_ll_options ll; 1440 1441 if (copy_from_sockptr(&ll, optval, optlen)) 1442 return -EFAULT; 1443 1444 /* check for correct ISO 11898-1 DLC data length */ 1445 if (ll.tx_dl != padlen(ll.tx_dl)) 1446 return -EINVAL; 1447 1448 if (ll.mtu != CAN_MTU && ll.mtu != CANFD_MTU) 1449 return -EINVAL; 1450 1451 if (ll.mtu == CAN_MTU && 1452 (ll.tx_dl > CAN_MAX_DLEN || ll.tx_flags != 0)) 1453 return -EINVAL; 1454 1455 memcpy(&so->ll, &ll, sizeof(ll)); 1456 1457 /* set ll_dl for tx path to similar place as for rx */ 1458 so->tx.ll_dl = ll.tx_dl; 1459 } else { 1460 return -EINVAL; 1461 } 1462 break; 1463 1464 default: 1465 ret = -ENOPROTOOPT; 1466 } 1467 1468 return ret; 1469 } 1470 1471 static int isotp_setsockopt(struct socket *sock, int level, int optname, 1472 sockptr_t optval, unsigned int optlen) 1473 1474 { 1475 struct sock *sk = sock->sk; 1476 int ret; 1477 1478 if (level != SOL_CAN_ISOTP) 1479 return -EINVAL; 1480 1481 lock_sock(sk); 1482 ret = isotp_setsockopt_locked(sock, level, optname, optval, optlen); 1483 release_sock(sk); 1484 return ret; 1485 } 1486 1487 static int isotp_getsockopt(struct socket *sock, int level, int optname, 1488 char __user *optval, int __user *optlen) 1489 { 1490 struct sock *sk = sock->sk; 1491 struct isotp_sock *so = isotp_sk(sk); 1492 int len; 1493 void *val; 1494 1495 if (level != SOL_CAN_ISOTP) 1496 return -EINVAL; 1497 if (get_user(len, optlen)) 1498 return -EFAULT; 1499 if (len < 0) 1500 return -EINVAL; 1501 1502 switch (optname) { 1503 case CAN_ISOTP_OPTS: 1504 len = min_t(int, len, sizeof(struct can_isotp_options)); 1505 val = &so->opt; 1506 break; 1507 1508 case CAN_ISOTP_RECV_FC: 1509 len = min_t(int, len, sizeof(struct can_isotp_fc_options)); 1510 val = &so->rxfc; 1511 break; 1512 1513 case CAN_ISOTP_TX_STMIN: 1514 len = min_t(int, len, sizeof(u32)); 1515 val = &so->force_tx_stmin; 1516 break; 1517 1518 case CAN_ISOTP_RX_STMIN: 1519 len = min_t(int, len, sizeof(u32)); 1520 val = &so->force_rx_stmin; 1521 break; 1522 1523 case CAN_ISOTP_LL_OPTS: 1524 len = min_t(int, len, sizeof(struct can_isotp_ll_options)); 1525 val = &so->ll; 1526 break; 1527 1528 default: 1529 return -ENOPROTOOPT; 1530 } 1531 1532 if (put_user(len, optlen)) 1533 return -EFAULT; 1534 if (copy_to_user(optval, val, len)) 1535 return -EFAULT; 1536 return 0; 1537 } 1538 1539 static void isotp_notify(struct isotp_sock *so, unsigned long msg, 1540 struct net_device *dev) 1541 { 1542 struct sock *sk = &so->sk; 1543 1544 if (!net_eq(dev_net(dev), sock_net(sk))) 1545 return; 1546 1547 if (so->ifindex != dev->ifindex) 1548 return; 1549 1550 switch (msg) { 1551 case NETDEV_UNREGISTER: 1552 lock_sock(sk); 1553 /* remove current filters & unregister */ 1554 if (so->bound) { 1555 if (isotp_register_rxid(so)) 1556 can_rx_unregister(dev_net(dev), dev, so->rxid, 1557 SINGLE_MASK(so->rxid), 1558 isotp_rcv, sk); 1559 1560 can_rx_unregister(dev_net(dev), dev, so->txid, 1561 SINGLE_MASK(so->txid), 1562 isotp_rcv_echo, sk); 1563 } 1564 1565 so->ifindex = 0; 1566 so->bound = 0; 1567 release_sock(sk); 1568 1569 sk->sk_err = ENODEV; 1570 if (!sock_flag(sk, SOCK_DEAD)) 1571 sk_error_report(sk); 1572 break; 1573 1574 case NETDEV_DOWN: 1575 sk->sk_err = ENETDOWN; 1576 if (!sock_flag(sk, SOCK_DEAD)) 1577 sk_error_report(sk); 1578 break; 1579 } 1580 } 1581 1582 static int isotp_notifier(struct notifier_block *nb, unsigned long msg, 1583 void *ptr) 1584 { 1585 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 1586 1587 if (dev->type != ARPHRD_CAN) 1588 return NOTIFY_DONE; 1589 if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) 1590 return NOTIFY_DONE; 1591 if (unlikely(isotp_busy_notifier)) /* Check for reentrant bug. */ 1592 return NOTIFY_DONE; 1593 1594 spin_lock(&isotp_notifier_lock); 1595 list_for_each_entry(isotp_busy_notifier, &isotp_notifier_list, notifier) { 1596 spin_unlock(&isotp_notifier_lock); 1597 isotp_notify(isotp_busy_notifier, msg, dev); 1598 spin_lock(&isotp_notifier_lock); 1599 } 1600 isotp_busy_notifier = NULL; 1601 spin_unlock(&isotp_notifier_lock); 1602 return NOTIFY_DONE; 1603 } 1604 1605 static int isotp_init(struct sock *sk) 1606 { 1607 struct isotp_sock *so = isotp_sk(sk); 1608 1609 so->ifindex = 0; 1610 so->bound = 0; 1611 1612 so->opt.flags = CAN_ISOTP_DEFAULT_FLAGS; 1613 so->opt.ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS; 1614 so->opt.rx_ext_address = CAN_ISOTP_DEFAULT_EXT_ADDRESS; 1615 so->opt.rxpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; 1616 so->opt.txpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; 1617 so->opt.frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; 1618 so->frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; 1619 so->rxfc.bs = CAN_ISOTP_DEFAULT_RECV_BS; 1620 so->rxfc.stmin = CAN_ISOTP_DEFAULT_RECV_STMIN; 1621 so->rxfc.wftmax = CAN_ISOTP_DEFAULT_RECV_WFTMAX; 1622 so->ll.mtu = CAN_ISOTP_DEFAULT_LL_MTU; 1623 so->ll.tx_dl = CAN_ISOTP_DEFAULT_LL_TX_DL; 1624 so->ll.tx_flags = CAN_ISOTP_DEFAULT_LL_TX_FLAGS; 1625 1626 /* set ll_dl for tx path to similar place as for rx */ 1627 so->tx.ll_dl = so->ll.tx_dl; 1628 1629 so->rx.state = ISOTP_IDLE; 1630 so->tx.state = ISOTP_IDLE; 1631 1632 so->rx.buf = so->rx.sbuf; 1633 so->tx.buf = so->tx.sbuf; 1634 so->rx.buflen = ARRAY_SIZE(so->rx.sbuf); 1635 so->tx.buflen = ARRAY_SIZE(so->tx.sbuf); 1636 1637 hrtimer_init(&so->rxtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1638 so->rxtimer.function = isotp_rx_timer_handler; 1639 hrtimer_init(&so->txtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1640 so->txtimer.function = isotp_tx_timer_handler; 1641 hrtimer_init(&so->txfrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); 1642 so->txfrtimer.function = isotp_txfr_timer_handler; 1643 1644 init_waitqueue_head(&so->wait); 1645 spin_lock_init(&so->rx_lock); 1646 1647 spin_lock(&isotp_notifier_lock); 1648 list_add_tail(&so->notifier, &isotp_notifier_list); 1649 spin_unlock(&isotp_notifier_lock); 1650 1651 return 0; 1652 } 1653 1654 static __poll_t isotp_poll(struct file *file, struct socket *sock, poll_table *wait) 1655 { 1656 struct sock *sk = sock->sk; 1657 struct isotp_sock *so = isotp_sk(sk); 1658 1659 __poll_t mask = datagram_poll(file, sock, wait); 1660 poll_wait(file, &so->wait, wait); 1661 1662 /* Check for false positives due to TX state */ 1663 if ((mask & EPOLLWRNORM) && (so->tx.state != ISOTP_IDLE)) 1664 mask &= ~(EPOLLOUT | EPOLLWRNORM); 1665 1666 return mask; 1667 } 1668 1669 static int isotp_sock_no_ioctlcmd(struct socket *sock, unsigned int cmd, 1670 unsigned long arg) 1671 { 1672 /* no ioctls for socket layer -> hand it down to NIC layer */ 1673 return -ENOIOCTLCMD; 1674 } 1675 1676 static const struct proto_ops isotp_ops = { 1677 .family = PF_CAN, 1678 .release = isotp_release, 1679 .bind = isotp_bind, 1680 .connect = sock_no_connect, 1681 .socketpair = sock_no_socketpair, 1682 .accept = sock_no_accept, 1683 .getname = isotp_getname, 1684 .poll = isotp_poll, 1685 .ioctl = isotp_sock_no_ioctlcmd, 1686 .gettstamp = sock_gettstamp, 1687 .listen = sock_no_listen, 1688 .shutdown = sock_no_shutdown, 1689 .setsockopt = isotp_setsockopt, 1690 .getsockopt = isotp_getsockopt, 1691 .sendmsg = isotp_sendmsg, 1692 .recvmsg = isotp_recvmsg, 1693 .mmap = sock_no_mmap, 1694 }; 1695 1696 static struct proto isotp_proto __read_mostly = { 1697 .name = "CAN_ISOTP", 1698 .owner = THIS_MODULE, 1699 .obj_size = sizeof(struct isotp_sock), 1700 .init = isotp_init, 1701 }; 1702 1703 static const struct can_proto isotp_can_proto = { 1704 .type = SOCK_DGRAM, 1705 .protocol = CAN_ISOTP, 1706 .ops = &isotp_ops, 1707 .prot = &isotp_proto, 1708 }; 1709 1710 static struct notifier_block canisotp_notifier = { 1711 .notifier_call = isotp_notifier 1712 }; 1713 1714 static __init int isotp_module_init(void) 1715 { 1716 int err; 1717 1718 max_pdu_size = max_t(unsigned int, max_pdu_size, MAX_12BIT_PDU_SIZE); 1719 max_pdu_size = min_t(unsigned int, max_pdu_size, MAX_PDU_SIZE); 1720 1721 pr_info("can: isotp protocol (max_pdu_size %d)\n", max_pdu_size); 1722 1723 err = can_proto_register(&isotp_can_proto); 1724 if (err < 0) 1725 pr_err("can: registration of isotp protocol failed %pe\n", ERR_PTR(err)); 1726 else 1727 register_netdevice_notifier(&canisotp_notifier); 1728 1729 return err; 1730 } 1731 1732 static __exit void isotp_module_exit(void) 1733 { 1734 can_proto_unregister(&isotp_can_proto); 1735 unregister_netdevice_notifier(&canisotp_notifier); 1736 } 1737 1738 module_init(isotp_module_init); 1739 module_exit(isotp_module_exit); 1740