Hello Jakub, hello David,
this is a pull request of 5 patches for net/master.
The first patch is by Thadeu Lima de Souza Cascardo and fixes a
potential use-after-free in the CAN broadcast manager socket, by
delaying the release of struct bcm_op after synchronize_rcu().
Oliver Hartkopp's patch fixes a similar potential user-after-free in
the CAN gateway socket by synchronizing RCU operations before removing
gw job entry.
Another patch by Oliver Hartkopp fixes a potential use-after-free in
the ISOTP socket by omitting unintended hrtimer restarts on socket
release.
Oleksij Rempel's patch for the j1939 socket fixes a potential
use-after-free by setting the SOCK_RCU_FREE flag on the socket.
The last patch is by Pavel Skripkin and fixes a use-after-free in the
ems_usb CAN driver.
All patches are intended for stable and have stable@v.k.o on Cc.
regards,
Marc
---
The following changes since commit dda2626b86c2c1813b7bfdd10d2fdd849611fc97:
Merge branch 'ezchip-fixes' (2021-06-19 11:46:24 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.13-20210619
for you to fetch changes up to ab4a0b8fcb9a95c02909b62049811bd2e586aaa4:
net: can: ems_usb: fix use-after-free in ems_usb_disconnect() (2021-06-19 23:54:00 +0200)
----------------------------------------------------------------
linux-can-fixes-for-5.13-20210619
----------------------------------------------------------------
Oleksij Rempel (1):
can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done
Oliver Hartkopp (2):
can: gw: synchronize rcu operations before removing gw job entry
can: isotp: isotp_release(): omit unintended hrtimer restart on socket release
Pavel Skripkin (1):
net: can: ems_usb: fix use-after-free in ems_usb_disconnect()
Thadeu Lima de Souza Cascardo (1):
can: bcm: delay release of struct bcm_op after synchronize_rcu()
drivers/net/can/usb/ems_usb.c | 3 ++-
net/can/bcm.c | 7 ++++++-
net/can/gw.c | 3 +++
net/can/isotp.c | 7 ++++---
net/can/j1939/main.c | 4 ++++
net/can/j1939/socket.c | 3 +++
6 files changed, 22 insertions(+), 5 deletions(-)
