can: j1939: implement NETDEV_UNREGISTER notification handler

syzbot is reporting

  unregister_netdevice: waiting for vcan0 to become free. Usage count = 2

problem, for j1939 protocol did not have NETDEV_UNREGISTER notification
handler for undoing changes made by j1939_sk_bind().

Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct
callback") expects that a call to j1939_priv_put() can be unconditionally
delayed until j1939_sk_sock_destruct() is called. But we need to call
j1939_priv_put() against an extra ref held by j1939_sk_bind() call
(as a part of undoing changes made by j1939_sk_bind()) as soon as
NETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct()
is called via j1939_sk_release()). Otherwise, the extra ref on "struct
j1939_priv" held by j1939_sk_bind() call prevents "struct net_device" from
dropping the usage count to 1; making it impossible for
unregister_netdevice() to continue.

Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Tested-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Fixes: 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/ac9db9a4-6c30-416e-8b94-96e6559d55b2@I-love.SAKURA.ne.jp
[mkl: remove space in front of label]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h
index 31a93cae5111b50d54e10a061a9e235e81a1da1c..81f58924b4acd7a88debfb9d4c91529ab01ee854 100644 (file)
--- a/net/can/j1939/j1939-priv.h
+++ b/net/can/j1939/j1939-priv.h
@@ -212,6 +212,7 @@ void j1939_priv_get(struct j1939_priv *priv);
 
 /* notify/alert all j1939 sockets bound to ifindex */
 void j1939_sk_netdev_event_netdown(struct j1939_priv *priv);
+void j1939_sk_netdev_event_unregister(struct j1939_priv *priv);
 int j1939_cancel_active_session(struct j1939_priv *priv, struct sock *sk);
 void j1939_tp_init(struct j1939_priv *priv);
 

diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
index 7e8a20f2fc42b5fb95d1989688ae511a1706ef16..3706a872ecafdb3c2f279a723b4bc7961f8c6ee4 100644 (file)
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -377,6 +377,9 @@ static int j1939_netdev_notify(struct notifier_block *nb,
                j1939_sk_netdev_event_netdown(priv);
                j1939_ecu_unmap_all(priv);
                break;
+       case NETDEV_UNREGISTER:
+               j1939_sk_netdev_event_unregister(priv);
+               break;
        }
 
        j1939_priv_put(priv);

diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 3d8b588822f9d215448e9d62dc3ec514b5af420d..70ebc861ea2a93ef49ab169bb7b1aa3357036962 100644 (file)
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -1300,6 +1300,55 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv)
        read_unlock_bh(&priv->j1939_socks_lock);
 }
 
+void j1939_sk_netdev_event_unregister(struct j1939_priv *priv)
+{
+       struct sock *sk;
+       struct j1939_sock *jsk;
+       bool wait_rcu = false;
+
+rescan: /* The caller is holding a ref on this "priv" via j1939_priv_get_by_ndev(). */
+       read_lock_bh(&priv->j1939_socks_lock);
+       list_for_each_entry(jsk, &priv->j1939_socks, list) {
+               /* Skip if j1939_jsk_add() is not called on this socket. */
+               if (!(jsk->state & J1939_SOCK_BOUND))
+                       continue;
+               sk = &jsk->sk;
+               sock_hold(sk);
+               read_unlock_bh(&priv->j1939_socks_lock);
+               /* Check if j1939_jsk_del() is not yet called on this socket after holding
+                * socket's lock, for both j1939_sk_bind() and j1939_sk_release() call
+                * j1939_jsk_del() with socket's lock held.
+                */
+               lock_sock(sk);
+               if (jsk->state & J1939_SOCK_BOUND) {
+                       /* Neither j1939_sk_bind() nor j1939_sk_release() called j1939_jsk_del().
+                        * Make this socket no longer bound, by pretending as if j1939_sk_bind()
+                        * dropped old references but did not get new references.
+                        */
+                       j1939_jsk_del(priv, jsk);
+                       j1939_local_ecu_put(priv, jsk->addr.src_name, jsk->addr.sa);
+                       j1939_netdev_stop(priv);
+                       /* Call j1939_priv_put() now and prevent j1939_sk_sock_destruct() from
+                        * calling the corresponding j1939_priv_put().
+                        *
+                        * j1939_sk_sock_destruct() is supposed to call j1939_priv_put() after
+                        * an RCU grace period. But since the caller is holding a ref on this
+                        * "priv", we can defer synchronize_rcu() until immediately before
+                        * the caller calls j1939_priv_put().
+                        */
+                       j1939_priv_put(priv);
+                       jsk->priv = NULL;
+                       wait_rcu = true;
+               }
+               release_sock(sk);
+               sock_put(sk);
+               goto rescan;
+       }
+       read_unlock_bh(&priv->j1939_socks_lock);
+       if (wait_rcu)
+               synchronize_rcu();
+}
+
 static int j1939_sk_no_ioctlcmd(struct socket *sock, unsigned int cmd,
                                unsigned long arg)
 {