[PATCH] can: j1939: fix transport session leak and socket bind/connect validation
From: Hui Peng <hidden>
Date: 2026-09-19 22:34:30
Also in:
linux-can, lkml
Subsystem:
can network layer, can-j1939 network layer, the rest · Maintainers:
Oliver Hartkopp, Marc Kleine-Budde, Robin van der Gracht, Oleksij Rempel, Linus Torvalds
Fix two issues in net/can/j1939/:
1. In j1939_tp_rxtimer() and session teardown
(net/can/j1939/transport.c), ensure active transport sessions and
skbs are properly cancelled and released on error or timeout.
2. In net/can/j1939/socket.c, validate socket state and address fields
consistently across bind/connect/sendmsg.
Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Assisted-by: LLM
Signed-off-by: Hui Peng <redacted>
---diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 8fcfd13e5e6f..712bca1174d3 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c@@ -1672,10 +1672,15 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv, session->pkt.total = (len + 6) / 7; session->pkt.block = 0xff; if (skcb.addr.type != J1939_ETP) { - if (dat[3] != session->pkt.total) + if (dat[3] != session->pkt.total || !dat[4]) { netdev_alert(priv->ndev, "%s: 0x%p: strange total, %u != %u\n", __func__, session, session->pkt.total, dat[3]); + j1939_session_put(session); + j1939_xtp_tx_abort(priv, &skcb, true, + J1939_XTP_ABORT_FAULT, pgn); + return NULL; + } session->pkt.total = dat[3]; session->pkt.block = min(dat[3], dat[4]); }
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 1d4af472de4a..889d4718c46a 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c@@ -470,6 +470,10 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr_unsized *uaddr, in ret = -EINVAL; goto out_release_sock; } + if (j1939_sock_pending_get(&jsk->sk)) { + ret = -EBUSY; + goto out_release_sock; + } /* drop old references */ j1939_jsk_del(priv, jsk);