Oleksij Rempel
7eef18c047
can: j1939: j1939_session_deactivate(): clarify lifetime of session object ...
commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 upstream.
The j1939_session_deactivate() is decrementing the session ref-count and
potentially can free() the session. This would cause use-after-free
situation.
However, the code calling j1939_session_deactivate() does always hold
another reference to the session, so that it would not be free()ed in
this code path.
This patch adds a comment to make this clear and a WARN_ON, to ensure
that future changes will not violate this requirement. Further this
patch avoids dereferencing the session pointer as a precaution to avoid
use-after-free if the session is actually free()ed.
Fixes: 9d71dd0c70https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de
Reported-by: Xiaochen Zou <xzou017@ucr.edu>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-08-04 12:27:40 +02:00
net/802/garp: fix memleak in garp_request_join()
2021-07-31 08:19:38 +02:00
appletalk: Fix skb allocation size in loopback case
2021-04-07 14:47:41 +02:00
batman-adv: Avoid WARN_ON timing related checks
2021-06-23 14:41:23 +02:00
Bluetooth: Shutdown controller after workqueues are flushed or cancelled
2021-07-19 08:53:13 +02:00
bpfilter: Specify the log level for the kmsg message
2021-07-14 16:53:33 +02:00
net: bridge: sync fdb to new unicast-filtering ports
2021-07-25 14:35:14 +02:00
net: fix uninit-value in caif_seqpkt_sendmsg
2021-07-28 13:30:56 +02:00
can: j1939: j1939_session_deactivate(): clarify lifetime of session object
2021-08-04 12:27:40 +02:00
net: annotate data race around sk_ll_usec
2021-07-31 08:19:38 +02:00
ipv6: weaken the v4mapped source check
2021-04-07 14:47:38 +02:00
net: decnet: Fix sleeping inside in af_decnet
2021-07-28 13:30:56 +02:00
net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count
2021-06-03 08:59:12 +02:00
hsr: use netdev_err() instead of WARN_ONCE()
2021-05-14 09:44:10 +02:00
net: ieee802154: fix null deref in parse dev addr
2021-06-18 09:58:57 +02:00
net: Set true network header for ECN decapsulation
2021-08-04 12:27:39 +02:00
ipv6: ip6_finish_output2: set sk into newly allocated nskb
2021-07-31 08:19:39 +02:00
net: llc: fix skb_over_panic
2021-08-04 12:27:39 +02:00
mac80211: remove iwlwifi specific workaround NDPs of null_response
2021-07-14 16:53:32 +02:00
net: mac802154: Fix general protection fault
2021-04-14 08:24:18 +02:00
net/ncsi: Avoid channel_monitor hrtimer deadlock
2021-04-14 08:24:15 +02:00
netfilter: nft_nat: allow to specify layer 4 protocol NAT only
2021-08-04 12:27:38 +02:00
netlabel: Fix memory leak in netlbl_mgmt_add_common
2021-07-14 16:53:29 +02:00
netlink: disable IRQs for netlink_lock_table()
2021-06-16 11:59:34 +02:00
netrom: Decrease sock refcount when sock timers expire
2021-07-28 13:30:56 +02:00
net/nfc/rawsock.c: fix a permission check bug
2021-06-16 11:59:33 +02:00
openvswitch: meter: fix race when getting now_ms.
2021-06-03 08:59:13 +02:00
net/packet: annotate accesses to po->ifindex
2021-06-30 08:47:48 -04:00
net: qrtr: fix OOB Read in qrtr_endpoint_post
2021-06-23 14:41:25 +02:00
net: rds: fix memory leak in rds_recvmsg
2021-06-23 14:41:24 +02:00
net_sched: check error pointer in tcf_dump_walker()
2021-08-04 12:27:37 +02:00
sctp: fix return value check in __sctp_rcv_asconf_lookup
2021-08-04 12:27:40 +02:00
Revert "net/smc: fix a NULL pointer dereference"
2021-06-03 08:59:08 +02:00
SUNRPC: Should wake up the privileged task firstly.
2021-07-14 16:53:05 +02:00
tipc: fix sleeping in tipc accept routine
2021-08-04 12:27:39 +02:00
tls: prevent oversized sendfile() hangs by ignoring MSG_MORE
2021-07-14 16:53:31 +02:00
af_unix: fix garbage collect vs MSG_PEEK
2021-07-31 08:19:37 +02:00
vsock: notify server to shutdown when client has pending signal
2021-07-19 08:53:12 +02:00
cfg80211: Fix possible memory leak in function cfg80211_bss_update
2021-08-04 12:27:38 +02:00
net/x25: Return the correct errno code
2021-06-18 09:59:00 +02:00
xsk: Simplify detection of empty and full rings
2021-05-22 11:38:27 +02:00
xfrm: Fix error reporting in xfrm_state_construct.
2021-07-19 08:53:11 +02:00
net: Return the correct errno code
2021-06-18 09:59:00 +02:00
net: make get_net_ns return error if NET_NS is disabled
2021-06-23 14:41:25 +02:00
7eef18c047