Forgot one comment.
On Fri 13 May 2022 at 03:29, Max Staudt <max@xxxxxxxxx> wrote:
[...]
> +/* Send a can_frame to a TTY. */
> +static netdev_tx_t can327_netdev_start_xmit(struct sk_buff *skb,
> + struct net_device *dev)
> +{
> + struct can327 *elm = netdev_priv(dev);
> + struct can_frame *frame = (struct can_frame *)skb->data;
> +
> + if (can_dropped_invalid_skb(dev, skb))
> + return NETDEV_TX_OK;
> +
> + /* BHs are already disabled, so no spin_lock_bh().
> + * See Documentation/networking/netdevices.txt
> + */
> + spin_lock(&elm->lock);
> +
> + /* We shouldn't get here after a hardware fault:
> + * can_bus_off() calls netif_carrier_off()
> + */
> + WARN_ON_ONCE(elm->uart_side_failure);
> +
> + if (!elm->tty ||
> + elm->uart_side_failure ||
> + elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
> + spin_unlock(&elm->lock);
> + goto out;
> + }
> +
> + netif_stop_queue(dev);
> +
> + elm327_send_frame(elm, frame);
> + spin_unlock(&elm->lock);
> +
> + dev->stats.tx_packets++;
> + dev->stats.tx_bytes += frame->len;
Do not increase tx_bytes for RTR frame. c.f.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc4b08c31b5c51352f258032cc65e884b3e61e6a
Also, when is the frame freed? Did you double check there is no race
condition resulting in a use after free on frame->len? Similar to:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=03f16c5075b22c8902d2af739969e878b0879c94
> + can_led_event(dev, CAN_LED_EVENT_TX);
Please adjust according to Oliver's patch.
> +out:
> + kfree_skb(skb);
> + return NETDEV_TX_OK;
> +}
> +
> +static const struct net_device_ops can327_netdev_ops = {
> + .ndo_open = can327_netdev_open,
> + .ndo_stop = can327_netdev_close,
> + .ndo_start_xmit = can327_netdev_start_xmit,
> + .ndo_change_mtu = can_change_mtu,
> +};
[...]
Yours sincerely,
Vincent Mailhol
