]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_g...
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Sun, 24 Aug 2025 10:30:09 +0000 (19:30 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 19 Sep 2025 14:29:58 +0000 (16:29 +0200)
commit2d8836fab0070edd7079945d36b61e60e6e307d9
tree47ce43a2e4a6d3266551bb00e63586d1927580a4
parentb905b2acb3a0bbb08ad9be9984d8cdabdf827315
can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed

[ Upstream commit f214744c8a27c3c1da6b538c232da22cd027530e ]

Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct
callback") expects that a call to j1939_priv_put() can be unconditionally
delayed until j1939_sk_sock_destruct() is called. But a refcount leak will
happen when j1939_sk_bind() is called again after j1939_local_ecu_get()
 from previous j1939_sk_bind() call returned an error. We need to call
j1939_priv_put() before j1939_sk_bind() returns an error.

Fixes: 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/4f49a1bc-a528-42ad-86c0-187268ab6535@I-love.SAKURA.ne.jp
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/can/j1939/socket.c