Skip to content
Snippets Groups Projects
Commit a5a4c5c4 authored by Fedor Pchelkin's avatar Fedor Pchelkin Committed by Zheng Zengkai
Browse files

can: j1939: j1939_session_destroy(): fix memory leak of skbs

stable inclusion
from stable-v5.10.138
commit	a220ff343396bae8d3b6abee72ab51f1f34b3027
category: bugfix
bugzilla: 187869, https://gitee.com/src-openeuler/kernel/issues/I5X3MU
CVE: CVE-2022-3633

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a220ff343396bae8d3b6abee72ab51f1f34b3027

--------------------------------

commit 8c21c54a53ab21842f5050fa090f26b03c0313d6 upstream.

We need to drop skb references taken in j1939_session_skb_queue() when
destroying a session in j1939_session_destroy(). Otherwise those skbs
would be lost.

Link to Syzkaller info and repro: https://forge.ispras.ru/issues/11743.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

V1: https://lore.kernel.org/all/20220708175949.539064-1-pchelkin@ispras.ru



Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
Suggested-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/all/20220805150216.66313-1-pchelkin@ispras.ru


Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent b95052d2
No related branches found
Tags 5.10.0-60.62.0
No related merge requests found
......@@ -260,6 +260,8 @@ static void __j1939_session_drop(struct j1939_session *session)
static void j1939_session_destroy(struct j1939_session *session)
{
struct sk_buff *skb;
if (session->err)
j1939_sk_errqueue(session, J1939_ERRQUEUE_ABORT);
else
......@@ -270,7 +272,11 @@ static void j1939_session_destroy(struct j1939_session *session)
WARN_ON_ONCE(!list_empty(&session->sk_session_queue_entry));
WARN_ON_ONCE(!list_empty(&session->active_session_list_entry));
skb_queue_purge(&session->skb_queue);
while ((skb = skb_dequeue(&session->skb_queue)) != NULL) {
/* drop ref taken in j1939_session_skb_queue() */
skb_unref(skb);
kfree_skb(skb);
}
__j1939_session_drop(session);
j1939_priv_put(session->priv);
kfree(session);
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment