This patchset fixes 3 standard conformance problems in the j1939 stack.
v2:
- Add netdev_err_once() to indicate bad messages on the bus.
- Fix the if statement in the third patch to avoid breaking ETP
functionality.
Zhang Changzhong (3):
can: j1939: j1939_tp_cmd_recv(): ignore abort message in the BAM
transport
can: j1939: j1939_can_recv(): ignore messages with invalid source
address
can: j1939: j1939_tp_cmd_recv(): check the dst address of TP.CM_BAM
net/can/j1939/main.c | 6 ++++++
net/can/j1939/transport.c | 11 +++++++++++
2 files changed, 17 insertions(+)
--
2.9.5
The TP.CM_BAM message must be sent to the global address [1], so add a
check to drop TP.CM_BAM sent to a non-global address.
Without this patch, the receiver will treat the following packets as
normal RTS/CTS tranport:
18EC0102#20090002FF002301
18EB0102#0100000000000000
18EB0102#020000FFFFFFFFFF
[1] SAE-J1939-82 2015 A.3.3 Row 1.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Signed-off-by: Zhang Changzhong <[email protected]>
---
net/can/j1939/transport.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 05eb3d0..a271688 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -2023,6 +2023,11 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb)
extd = J1939_ETP;
fallthrough;
case J1939_TP_CMD_BAM:
+ if (cmd == J1939_TP_CMD_BAM && !j1939_cb_is_broadcast(skcb)) {
+ netdev_err_once(priv->ndev, "%s: BAM to unicast (%02x), ignoring!\n",
+ __func__, skcb->addr.sa);
+ return;
+ }
fallthrough;
case J1939_TP_CMD_RTS:
if (skcb->addr.type != extd)
--
2.9.5
This patch prevents BAM transport from being closed by receiving abort
message, as specified in SAE-J1939-82 2015 (A.3.3 Row 4).
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Signed-off-by: Zhang Changzhong <[email protected]>
---
net/can/j1939/transport.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 6c0a0eb..05eb3d0 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -2085,6 +2085,12 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb)
break;
case J1939_ETP_CMD_ABORT: /* && J1939_TP_CMD_ABORT */
+ if (j1939_cb_is_broadcast(skcb)) {
+ netdev_err_once(priv->ndev, "%s: abort to broadcast (%02x), ignoring!\n",
+ __func__, skcb->addr.sa);
+ return;
+ }
+
if (j1939_tp_im_transmitter(skcb))
j1939_xtp_rx_abort(priv, skb, true);
--
2.9.5
On Thu, Oct 28, 2021 at 10:38:25PM +0800, Zhang Changzhong wrote:
> This patch prevents BAM transport from being closed by receiving abort
> message, as specified in SAE-J1939-82 2015 (A.3.3 Row 4).
>
> Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
> Signed-off-by: Zhang Changzhong <[email protected]>
Acked-by: Oleksij Rempel <[email protected]>
> ---
> net/can/j1939/transport.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
> index 6c0a0eb..05eb3d0 100644
> --- a/net/can/j1939/transport.c
> +++ b/net/can/j1939/transport.c
> @@ -2085,6 +2085,12 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb)
> break;
>
> case J1939_ETP_CMD_ABORT: /* && J1939_TP_CMD_ABORT */
> + if (j1939_cb_is_broadcast(skcb)) {
> + netdev_err_once(priv->ndev, "%s: abort to broadcast (%02x), ignoring!\n",
> + __func__, skcb->addr.sa);
> + return;
> + }
> +
> if (j1939_tp_im_transmitter(skcb))
> j1939_xtp_rx_abort(priv, skb, true);
>
> --
> 2.9.5
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
On Thu, Oct 28, 2021 at 10:38:27PM +0800, Zhang Changzhong wrote:
> The TP.CM_BAM message must be sent to the global address [1], so add a
> check to drop TP.CM_BAM sent to a non-global address.
>
> Without this patch, the receiver will treat the following packets as
> normal RTS/CTS tranport:
> 18EC0102#20090002FF002301
> 18EB0102#0100000000000000
> 18EB0102#020000FFFFFFFFFF
>
> [1] SAE-J1939-82 2015 A.3.3 Row 1.
>
> Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
> Signed-off-by: Zhang Changzhong <[email protected]>
Acked-by: Oleksij Rempel <[email protected]>
> ---
> net/can/j1939/transport.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
> index 05eb3d0..a271688 100644
> --- a/net/can/j1939/transport.c
> +++ b/net/can/j1939/transport.c
> @@ -2023,6 +2023,11 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb)
> extd = J1939_ETP;
> fallthrough;
> case J1939_TP_CMD_BAM:
> + if (cmd == J1939_TP_CMD_BAM && !j1939_cb_is_broadcast(skcb)) {
> + netdev_err_once(priv->ndev, "%s: BAM to unicast (%02x), ignoring!\n",
> + __func__, skcb->addr.sa);
> + return;
> + }
> fallthrough;
> case J1939_TP_CMD_RTS:
> if (skcb->addr.type != extd)
> --
> 2.9.5
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
On 28.10.2021 22:38:24, Zhang Changzhong wrote:
> This patchset fixes 3 standard conformance problems in the j1939 stack.
Applied to linux-can/testing added stable on Cc.
thanks,
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung West/Dortmund | Phone: +49-231-2826-924 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |