From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590404; b=O9Q4RlM6SLvNetE1/IMhJ45FwlhxWUeS0HNhvdqUvFRiDyMHWN2IcXdGUuWb3JSvkHJX sFR9jglPdfMvu340J1OYLCY3PZuID8FID/8yOc/wCpS3y8AzADl1Hnr5K1bXEN84XWO4V ZcRhV8DNYoF+5ii4z3pL904rmWNKZ6HHg8rQ6FlANj/WLHWuW10T3cNgBeuayRZcaYSO3 VnmGyLYGwyW83dQ2GhaKyRAkXfS+OLwo9ZIdjd99daVsxUF5RvHirBOhHK4teK9XR6vr0 ZjURxxPa9NeBFpmTquyRl2A1W6pp/KYffwkdw1IcbjfIVJ3ef3HIq1bbWnRIVjmMUNw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590404; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=QzNgujxxnG5Al5XKIktM+ySdrUzQnC6yRqLZAOQj2Rw=; b=SlCOfoXnqFoSR7H01O/ttRHIDFKLJCRSccSue9k94D+QA5cm0coILAz8aBJPfGj1rihW dXD9Y7ysR//EJ87ZEglHooBpVihGv/wkiUw7WYoDA7pZJelpAey05VjRxDrJ/ZFfkjlzU 2qf0+34FSsyjkNnNYFPG7DIvOjZO6M3HXYiYlszTNeMFI6/ss9VLZK7/Ra0kZC68D+I/G QdTW3AnDUeS4yjuJAnO0ineFtJjrc3ZvzRJNJBmYLHtCz0JKOGVr4OEsoQaMZimo+m9A5 4JXJ4miYYarVguAyNLvu+CUTIpIbB5AjjFgiS/ic1eMaQPxPUeUKjTFDaU7A1Sy+AOw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=tdMjUKoD; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC19F606B451; Fri, 13 Nov 2026 17:20:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=tdMjUKoD Received: by smtp.kernel.org (Postfix) with ESMTPSA id 592731F000C7; Fri, 13 Nov 2026 17:20:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590404; bh=QzNgujxxnG5Al5XKIktM+ySdrUzQnC6yRqLZAOQj2Rw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tdMjUKoDHnzubagsv6epwcMDqJQkcaPNlGCmIHyLF9IEbOZ5Uzo6o+4yi5CF3CaB9 FWIyxwuj6RxC6Hb7dTVXZQzi0uimo+rAXoEHsDPB80UcUoixpCxiiTCTwmYQqMxnJs rANSXWv+Kh0G6Te57pn1Gxl+L9VMYGb3zW8lrlmk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Oliver Hartkopp , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 6.18 364/686] can: isotp: check the return values of can_rx_register() in isotp_bind() Date: Fri, 13 Nov 2026 10:48:17 -0500 Message-ID: <20261113153833.236874478@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Hartkopp [ Upstream commit 874f5f14cf626f72477071eff381c8485554250d ] isotp_bind() ignores the return values of can_rx_register() for the RX and the echo receiver and binds the socket anyway. When a receiver can not be allocated, bind() succeeds without this receiver, so the socket does not receive frames or its transmissions time out. isotp_release() and isotp_notify() later try to remove the missing receiver, which triggers the "receive list entry not found" warning in can_rx_unregister(). As the device has been checked before and RTNL prevents a namespace change during bind(), only -ENOMEM can be returned here. Check the return values and register the RX receiver as the last step. The echo receiver is registered first, as it only handles the socket's own echo frames and does nothing while no transmission is in progress. So a failed RX registration only needs to remove the echo receiver, and isotp_rcv() has never processed a frame for this socket. Set so->ifindex before the registrations, so that a First Frame received before so->bound is set can be answered with a Flow Control frame and the RX timeout is started as usual. As the RX receiver is registered last, this can only happen for a bind() that succeeds. Reset so->ifindex when bind() fails. Check IFF_UP only after the receivers have been registered, so that a bind() that fails on a down device does not report ENETDOWN. As bind() holds RTNL, the device state can not change in between. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Cc: stable@vger.kernel.org Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20261027-can-rx-lock-v12-2-eb5afc2d8b9b@hartkopp.net Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin --- net/can/isotp.c | 42 +++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/net/can/isotp.c b/net/can/isotp.c index 39cd943df19ec..e3261fb4663af 100644 --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -1527,7 +1527,6 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) struct sock *sk = sock->sk; struct isotp_sock *so = isotp_sk(sk); struct net *net = sock_net(sk); - int ifindex; struct net_device *dev; canid_t tx_id = addr->can_addr.tp.tx_id; canid_t rx_id = addr->can_addr.tp.rx_id; @@ -1604,26 +1603,36 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) err = -EINVAL; goto out_put_dev; } - if (!(dev->flags & IFF_UP)) - notify_enetdown = 1; - ifindex = dev->ifindex; - - if (isotp_register_rxid(so)) - can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id), - isotp_rcv, sk, "isotp", sk); + /* switch to new settings */ + so->ifindex = dev->ifindex; + so->rxid = rx_id; + so->txid = tx_id; /* no consecutive frame echo skb in flight */ WRITE_ONCE(so->cfecho, 0); - /* register for echo skb's */ - can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id), - isotp_rcv_echo, sk, "isotpe", sk); + /* register for echo skb's first (no echo traffic at this point) */ + err = can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id), + isotp_rcv_echo, sk, "isotpe", sk); + if (err) + goto out_put_dev; + + if (isotp_register_rxid(so)) { + err = can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id), + isotp_rcv, sk, "isotp", sk); + if (err) { + /* unregister echo skb subscription */ + can_rx_unregister(net, dev, tx_id, SINGLE_MASK(tx_id), + isotp_rcv_echo, sk); + goto out_put_dev; + } + } + + /* report a down device only for a successful bind() */ + if (!(dev->flags & IFF_UP)) + notify_enetdown = 1; - /* switch to new settings */ - so->ifindex = ifindex; - so->rxid = rx_id; - so->txid = tx_id; so->bound = 1; /* bind() ok -> hold a reference for so->dev so that isotp_release() @@ -1634,6 +1643,9 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) netdev_hold(so->dev, &so->dev_tracker, GFP_KERNEL); out_put_dev: + if (err) + so->ifindex = 0; /* reset on failed bind() */ + /* remove potential reference from dev_get_by_index() */ dev_put(dev); out: -- 2.53.0