lkml.org 
[lkml]   [2024]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] [can?] KASAN: slab-use-after-free Read in j1939_xtp_rx_dat_one
Date
On Sat, 13 Apr 2024 23:27:33 -0700
> syzbot found the following issue on:
>
> HEAD commit: 2c71fdf02a95 Merge tag 'drm-fixes-2024-04-09' of https://g..
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ae00cb180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c71fdf02a95

--- x/net/can/j1939/transport.c
+++ y/net/can/j1939/transport.c
@@ -2122,10 +2122,12 @@ static void j1939_tp_cmd_recv(struct j19
int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb)
{
struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb);
+ int ret = 1;

if (!j1939_tp_im_involved_anydir(skcb) && !j1939_cb_is_broadcast(skcb))
return 0;

+ skb_get(skb);
switch (skcb->addr.pgn) {
case J1939_ETP_PGN_DAT:
skcb->addr.type = J1939_ETP;
@@ -2138,14 +2140,18 @@ int j1939_tp_recv(struct j1939_priv *pri
skcb->addr.type = J1939_ETP;
fallthrough;
case J1939_TP_PGN_CTL:
- if (skb->len < 8)
- return 0; /* Don't care. Nothing to extract here */
+ if (skb->len < 8) {
+ ret = 0; /* Don't care. Nothing to extract here */
+ break;
+ }

j1939_tp_cmd_recv(priv, skb);
break;
default:
- return 0; /* no problem */
+ ret = 0; /* no problem */
+ break;
}
+ kfree_skb(skb);
return 1; /* "I processed the message" */
}

--
\
 
 \ /
  Last update: 2024-05-27 16:40    [W:0.038 / U:0.096 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site