can: isotp: prevent race between isotp_bind() and isotp_setsockopt()
commit 2b17c400 upstream. A race condition was found in isotp_setsockopt() which allows to change socket options after the socket was bound. For the specific case of SF_BROADCAST support, this might lead to possible use-after-free because can_rx_unregister() is not called. Checking for the flag under the socket lock in isotp_bind() and taking the lock in isotp_setsockopt() fixes the issue. Fixes: 921ca574 ("can: isotp: add SF_BROADCAST support for functional addressing") Link: https://lore.kernel.org/r/trinity-e6ae9efa-9afb-4326-84c0-f3609b9b8168-1620773528307@3c-app-gmx-bs06 Reported-by:Norbert Slusarek <nslusarek@gmx.net> Signed-off-by:
Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by:
Norbert Slusarek <nslusarek@gmx.net> Acked-by:
Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by:
Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by:
Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
db3f3636
Please register or sign in to comment