iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
64295f0d01
linux/net/can/j1939
History
Oleksij Rempel 2030043e61 can: j1939: fix Use-after-Free, hold skb ref while in use 
This patch fixes a Use-after-Free found by the syzbot.

The problem is that a skb is taken from the per-session skb queue,
without incrementing the ref count. This leads to a Use-after-Free if
the skb is taken concurrently from the session queue due to a CTS.

Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/r/20210521115720.7533-1-o.rempel@pengutronix.de
Cc: Hillf Danton <hdanton@sina.com>
Cc: linux-stable <stable@vger.kernel.org>
Reported-by: syzbot+220c1a29987a9a490903@syzkaller.appspotmail.com
Reported-by: syzbot+45199c1b73b4013525cf@syzkaller.appspotmail.com
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2021-06-16 12:52:18 +02:00
..
address-claim.c
bus.c
j1939-priv.h
Kconfig
main.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
Makefile
socket.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
transport.c can: j1939: fix Use-after-Free, hold skb ref while in use 2021-06-16 12:52:18 +02:00