This error was detected by stress testing different error paths.
For example if we received a second rts on the same connection
session refcounting was not decremented so it would be never freed.
Signed-off-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx>
---
net/can/j1939/transport.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 8e73d68fdea3..777a78c95110 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1518,8 +1518,10 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb)
* TP is pending in the other direction
*/
if (session) {
- if (j1939_xtp_rx_rts_current(session, skb))
+ if (j1939_xtp_rx_rts_current(session, skb)) {
+ j1939_session_put(session);
break;
+ }
} else {
session = j1939_xtp_rx_rts_new(priv, skb);
if (!session)
--
2.20.1
