kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/can
History
Samuel Page 64c8553dec can: raw: fix ro->uniq use-after-free in raw_rcv() 
commit a535a9217c upstream.

raw_release() unregisters raw CAN receive filters via can_rx_unregister(),
but receiver deletion is deferred with call_rcu(). This leaves a window
where raw_rcv() may still be running in an RCU read-side critical section
after raw_release() frees ro->uniq, leading to a use-after-free of the
percpu uniq storage.

Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific
socket destructor. can_rx_unregister() takes an extra reference to the
socket and only drops it from the RCU callback, so freeing uniq from
sk_destruct ensures the percpu area is not released until the relevant
callbacks have drained.

Fixes: 514ac99c64 ("can: fix multiple delivery of a single CAN frame for overlapping CAN filters")
Cc: stable@vger.kernel.org # v4.1+
Assisted-by: Bynario AI
Signed-off-by: Samuel Page <sam@bynar.io>
Link: https://patch.msgid.link/26ec626d-cae7-4418-9782-7198864d070c@bynar.io
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
[mkl: applied manually]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-01 17:35:04 +02:00
..
j1939 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts 2026-02-06 16:41:47 +01:00
af_can.c can: statistics: add missing atomic access in hot path 2026-04-18 10:33:24 +02:00
af_can.h can: statistics: add missing atomic access in hot path 2026-04-18 10:33:24 +02:00
bcm.c can: bcm: fix locking for bcm_op runtime updates 2026-04-18 10:33:10 +02:00
gw.c can: gw: fix OOB heap access in cgw_csum_crc8_rel() 2026-04-18 10:33:27 +02:00
isotp.c can: isotp: isotp_sendmsg(): fix TX state detection and wait behavior 2023-11-08 17:26:49 +01:00
Kconfig net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
Makefile can: add ISO 15765-2:2016 transport protocol 2020-10-07 23:18:33 +02:00
proc.c can: statistics: add missing atomic access in hot path 2026-04-18 10:33:24 +02:00
raw.c can: raw: fix ro->uniq use-after-free in raw_rcv() 2026-06-01 17:35:04 +02:00