Oleksij Rempel 2030043e61 can: j1939: fix Use-after-Free, hold skb ref while in use ... This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to a Use-after-Free if the skb is taken concurrently from the session queue due to a CTS. Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol") Link: https://lore.kernel.org/r/20210521115720.7533-1-o.rempel@pengutronix.de Cc: Hillf Danton <hdanton@sina.com> Cc: linux-stable <stable@vger.kernel.org> Reported-by: syzbot+220c1a29987a9a490903@syzkaller.appspotmail.com Reported-by: syzbot+45199c1b73b4013525cf@syzkaller.appspotmail.com Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>		2021-06-16 12:52:18 +02:00
..
j1939	can: j1939: fix Use-after-Free, hold skb ref while in use	2021-06-16 12:52:18 +02:00
af_can.c	net: introduce CAN specific pointer in the struct net_device	2021-02-24 14:32:15 -08:00
af_can.h	can: introduce CAN midlayer private and allocate it automatically	2019-09-04 13:29:14 +02:00
bcm.c	can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE	2021-03-29 09:51:20 +02:00
gw.c	can: gw: fix typo	2021-01-27 10:01:46 +01:00
isotp.c	can: isotp: prevent race between isotp_bind() and isotp_setsockopt()	2021-05-12 08:52:47 +02:00
Kconfig	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
Makefile	can: add ISO 15765-2:2016 transport protocol	2020-10-07 23:18:33 +02:00
proc.c	can: proc: fix rcvlist_* header alignment on 64-bit system	2021-04-25 19:43:00 +02:00
raw.c	can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE	2021-03-29 09:51:20 +02:00