Skip to content
Commit 628f725d authored by Marc Kleine-Budde's avatar Marc Kleine-Budde
Browse files

Merge patch series "can: j1939: avoid possible use-after-free when j1939_can_rx_register fails"



Fedor Pchelkin <pchelkin@ispras.ru> says:

The patch series fixes a possible racy use-after-free scenario
described in 2/2: if j1939_can_rx_register() fails then the concurrent
thread may have already read the invalid priv structure.

The 1/2 makes j1939_netdev_lock a mutex so that access to
j1939_can_rx_register() can be serialized without changing GFP_KERNEL
to GFP_ATOMIC inside can_rx_register(). This seems to be safe.

Note that the patch series has been tested only via Syzkaller and not
with a real device.

Link: https://lore.kernel.org/r/20230526171910.227615-1-pchelkin@ispras.ru
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parents 2a84aea8 9f16eb10
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment