diff options
author | Oleksij Rempel <o.rempel@pengutronix.de> | 2021-07-14 13:16:02 +0200 |
---|---|---|
committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2021-07-24 19:01:53 +0200 |
commit | 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 (patch) | |
tree | 09d4b62306d47a94ec7d5d71fee72f3fb0ec7e8f /net/sched/cls_u32.c | |
parent | 54f93336d000229f72c26d8a3f69dd256b744528 (diff) | |
download | linux-0c71437dd50dd687c15d8ca80b3b68f10bb21d63.tar.bz2 |
can: j1939: j1939_session_deactivate(): clarify lifetime of session object
The j1939_session_deactivate() is decrementing the session ref-count and
potentially can free() the session. This would cause use-after-free
situation.
However, the code calling j1939_session_deactivate() does always hold
another reference to the session, so that it would not be free()ed in
this code path.
This patch adds a comment to make this clear and a WARN_ON, to ensure
that future changes will not violate this requirement. Further this
patch avoids dereferencing the session pointer as a precaution to avoid
use-after-free if the session is actually free()ed.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de
Reported-by: Xiaochen Zou <xzou017@ucr.edu>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'net/sched/cls_u32.c')
0 files changed, 0 insertions, 0 deletions