]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
can: j1939: j1939_session_deactivate(): clarify lifetime of session object
authorOleksij Rempel <o.rempel@pengutronix.de>
Wed, 14 Jul 2021 11:16:02 +0000 (13:16 +0200)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Sat, 24 Jul 2021 17:01:53 +0000 (19:01 +0200)
commit0c71437dd50dd687c15d8ca80b3b68f10bb21d63
tree09d4b62306d47a94ec7d5d71fee72f3fb0ec7e8f
parent54f93336d000229f72c26d8a3f69dd256b744528
can: j1939: j1939_session_deactivate(): clarify lifetime of session object

The j1939_session_deactivate() is decrementing the session ref-count and
potentially can free() the session. This would cause use-after-free
situation.

However, the code calling j1939_session_deactivate() does always hold
another reference to the session, so that it would not be free()ed in
this code path.

This patch adds a comment to make this clear and a WARN_ON, to ensure
that future changes will not violate this requirement. Further this
patch avoids dereferencing the session pointer as a precaution to avoid
use-after-free if the session is actually free()ed.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de
Reported-by: Xiaochen Zou <xzou017@ucr.edu>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
net/can/j1939/transport.c