Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Hillf Danton <> | Subject | Re: [syzbot] [can?] KASAN: slab-use-after-free Read in j1939_xtp_rx_dat_one | Date | Sun, 14 Apr 2024 17:30:11 +0800 |
| |
On Sat, 13 Apr 2024 23:27:33 -0700 > syzbot found the following issue on: > > HEAD commit: 2c71fdf02a95 Merge tag 'drm-fixes-2024-04-09' of https://g.. > git tree: upstream > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ae00cb180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2c71fdf02a95
--- x/net/can/j1939/transport.c +++ y/net/can/j1939/transport.c @@ -2122,10 +2122,12 @@ static void j1939_tp_cmd_recv(struct j19 int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb) { struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb); + int ret = 1; if (!j1939_tp_im_involved_anydir(skcb) && !j1939_cb_is_broadcast(skcb)) return 0; + skb_get(skb); switch (skcb->addr.pgn) { case J1939_ETP_PGN_DAT: skcb->addr.type = J1939_ETP; @@ -2138,14 +2140,18 @@ int j1939_tp_recv(struct j1939_priv *pri skcb->addr.type = J1939_ETP; fallthrough; case J1939_TP_PGN_CTL: - if (skb->len < 8) - return 0; /* Don't care. Nothing to extract here */ + if (skb->len < 8) { + ret = 0; /* Don't care. Nothing to extract here */ + break; + } j1939_tp_cmd_recv(priv, skb); break; default: - return 0; /* no problem */ + ret = 0; /* no problem */ + break; } + kfree_skb(skb); return 1; /* "I processed the message" */ } --
| ![\](/images/icornerr.gif) |