This error was detected by stress testing different error paths. For example if we received a second rts on the same connection session refcounting was not decremented so it would be never freed. Signed-off-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx> --- net/can/j1939/transport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 8e73d68fdea3..777a78c95110 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1518,8 +1518,10 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb) * TP is pending in the other direction */ if (session) { - if (j1939_xtp_rx_rts_current(session, skb)) + if (j1939_xtp_rx_rts_current(session, skb)) { + j1939_session_put(session); break; + } } else { session = j1939_xtp_rx_rts_new(priv, skb); if (!session) -- 2.20.1