Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <20220512182921.193462-1-max@enpas.org>
In-Reply-To: <20220512182921.193462-1-max@enpas.org>
From:   Vincent Mailhol <vincent.mailhol@gmail.com>
Date:   Thu, 19 May 2022 01:24:00 +0900
Message-ID: <CAMZ6RqJqW+RuPOe6wYkAQh500BzVWnx9hcSAC3bvC7zYNYV-iw@mail.gmail.com>
Subject: Re: [PATCH v6] can, tty: can327 CAN/ldisc driver for ELM327 based
 OBD-II adapters
To:     Max Staudt <max@enpas.org>
Cc:     Wolfgang Grandegger <wg@grandegger.com>,
        Marc Kleine-Budde <mkl@pengutronix.de>,
        linux-can@vger.kernel.org,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Oliver Neukum <oneukum@suse.com>, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Forgot one comment.

On Fri 13 May 2022 at 03:29, Max Staudt <max@enpas.org> wrote:
[...]
> +/* Send a can_frame to a TTY. */
> +static netdev_tx_t can327_netdev_start_xmit(struct sk_buff *skb,
> +                                           struct net_device *dev)
> +{
> +       struct can327 *elm = netdev_priv(dev);
> +       struct can_frame *frame = (struct can_frame *)skb->data;
> +
> +       if (can_dropped_invalid_skb(dev, skb))
> +               return NETDEV_TX_OK;
> +
> +       /* BHs are already disabled, so no spin_lock_bh().
> +        * See Documentation/networking/netdevices.txt
> +        */
> +       spin_lock(&elm->lock);
> +
> +       /* We shouldn't get here after a hardware fault:
> +        * can_bus_off() calls netif_carrier_off()
> +        */
> +       WARN_ON_ONCE(elm->uart_side_failure);
> +
> +       if (!elm->tty ||
> +           elm->uart_side_failure ||
> +           elm->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) {
> +               spin_unlock(&elm->lock);
> +               goto out;
> +       }
> +
> +       netif_stop_queue(dev);
> +
> +       elm327_send_frame(elm, frame);
> +       spin_unlock(&elm->lock);
> +
> +       dev->stats.tx_packets++;
> +       dev->stats.tx_bytes += frame->len;

Do not increase tx_bytes for RTR frame. c.f.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc4b08c31b5c51352f258032cc65e884b3e61e6a

Also, when is the frame freed? Did you double check there is no race
condition resulting in a use after free on frame->len? Similar to:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=03f16c5075b22c8902d2af739969e878b0879c94

> +       can_led_event(dev, CAN_LED_EVENT_TX);

Please adjust according to Oliver's patch.

> +out:
> +       kfree_skb(skb);
> +       return NETDEV_TX_OK;
> +}
> +
> +static const struct net_device_ops can327_netdev_ops = {
> +       .ndo_open       = can327_netdev_open,
> +       .ndo_stop       = can327_netdev_close,
> +       .ndo_start_xmit = can327_netdev_start_xmit,
> +       .ndo_change_mtu = can_change_mtu,
> +};
[...]

Yours sincerely,
Vincent Mailhol