Commit 8c21c54a authored by Fedor Pchelkin's avatar Fedor Pchelkin Committed by Marc Kleine-Budde

can: j1939: j1939_session_destroy(): fix memory leak of skbs

We need to drop skb references taken in j1939_session_skb_queue() when
destroying a session in j1939_session_destroy(). Otherwise those skbs
would be lost.

Link to Syzkaller info and repro: https://forge.ispras.ru/issues/11743.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

V1: https://lore.kernel.org/all/20220708175949.539064-1-pchelkin@ispras.ru

Fixes: 9d71dd0c ("can: add support of SAE J1939 protocol")
Suggested-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: default avatarOleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/all/20220805150216.66313-1-pchelkin@ispras.ruSigned-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 8ef49f7f
...@@ -260,6 +260,8 @@ static void __j1939_session_drop(struct j1939_session *session) ...@@ -260,6 +260,8 @@ static void __j1939_session_drop(struct j1939_session *session)
static void j1939_session_destroy(struct j1939_session *session) static void j1939_session_destroy(struct j1939_session *session)
{ {
struct sk_buff *skb;
if (session->transmission) { if (session->transmission) {
if (session->err) if (session->err)
j1939_sk_errqueue(session, J1939_ERRQUEUE_TX_ABORT); j1939_sk_errqueue(session, J1939_ERRQUEUE_TX_ABORT);
...@@ -274,7 +276,11 @@ static void j1939_session_destroy(struct j1939_session *session) ...@@ -274,7 +276,11 @@ static void j1939_session_destroy(struct j1939_session *session)
WARN_ON_ONCE(!list_empty(&session->sk_session_queue_entry)); WARN_ON_ONCE(!list_empty(&session->sk_session_queue_entry));
WARN_ON_ONCE(!list_empty(&session->active_session_list_entry)); WARN_ON_ONCE(!list_empty(&session->active_session_list_entry));
skb_queue_purge(&session->skb_queue); while ((skb = skb_dequeue(&session->skb_queue)) != NULL) {
/* drop ref taken in j1939_session_skb_queue() */
skb_unref(skb);
kfree_skb(skb);
}
__j1939_session_drop(session); __j1939_session_drop(session);
j1939_priv_put(session->priv); j1939_priv_put(session->priv);
kfree(session); kfree(session);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment