On Thu. 19 May 2022 at 01:24, Vincent Mailhol <vincent.mailhol@xxxxxxxxx> wrote:
> Forgot one comment.
>
> On Fri 13 May 2022 at 03:29, Max Staudt <max@xxxxxxxxx> wrote:
> [...]
> > +/* Send a can_frame to a TTY. */
> > +static netdev_tx_t can327_netdev_start_xmit(struct sk_buff *skb,
> > + struct net_device *dev)
> > +{
> > + struct can327 *elm = netdev_priv(dev);
> > + struct can_frame *frame = (struct can_frame *)skb->data;
> > +
> > + if (can_dropped_invalid_skb(dev, skb))
> > + return NETDEV_TX_OK;
> > +
> > + /* BHs are already disabled, so no spin_lock_bh().
> > + * See Documentation/networking/netdevices.txt
> > + */
> > + spin_lock(&elm->lock);
> > +
> > + /* We shouldn't get here after a hardware fault:
> > + * can_bus_off() calls netif_carrier_off()
> > + */
> > + WARN_ON_ONCE(elm->uart_side_failure);
> > +
> > + if (!elm->tty ||
> > + elm->uart_side_failure ||
> > + elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
> > + spin_unlock(&elm->lock);
> > + goto out;
> > + }
> > +
> > + netif_stop_queue(dev);
> > +
> > + elm327_send_frame(elm, frame);
> > + spin_unlock(&elm->lock);
> > +
> > + dev->stats.tx_packets++;
> > + dev->stats.tx_bytes += frame->len;
>
> Do not increase tx_bytes for RTR frame. c.f.
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc4b08c31b5c51352f258032cc65e884b3e61e6a
>
> Also, when is the frame freed? Did you double check there is no race
> condition resulting in a use after free on frame->len? Similar to:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=03f16c5075b22c8902d2af739969e878b0879c94
Never mind, the free is just two lines below inside the out label.
Sorry for the noise.
> > + can_led_event(dev, CAN_LED_EVENT_TX);
>
> Please adjust according to Oliver's patch.
>
> > +out:
> > + kfree_skb(skb);
> > + return NETDEV_TX_OK;
> > +}
> > +
> > +static const struct net_device_ops can327_netdev_ops = {
> > + .ndo_open = can327_netdev_open,
> > + .ndo_stop = can327_netdev_close,
> > + .ndo_start_xmit = can327_netdev_start_xmit,
> > + .ndo_change_mtu = can_change_mtu,
> > +};
> [...]
>
> Yours sincerely,
> Vincent Mailhol
