The root cause of this problem is when both of the following conditions are met simultaneously: [1] Introduced commit c9c0ee5f20c5, There are following rules: In debug builds (CONFIG_DEBUG_NET set), the reference count is always decremented, even when it's 1. [2] When executing sendmsg, the newly created session did not increase the skb reference count, only added skb to the session's skb_queue. The solution is: When creating a new session, do not add the skb to the skb_queue. Instead, when using skb, uniformly use j1939_session_skb_queue to add the skb to the queue and increase the skb reference count through it. Reported-and-tested-by: syzbot+ad601904231505ad6617@xxxxxxxxxxxxxxxxxxxxxxxxx Closes: https://syzkaller.appspot.com/bug?extid=ad601904231505ad6617 Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> --- net/can/j1939/socket.c | 7 ++++--- net/can/j1939/transport.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index 305dd72c844c..ec78bee1bfa6 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -1170,10 +1170,11 @@ static int j1939_sk_send_loop(struct j1939_priv *priv, struct sock *sk, break; } } - } else { - skcb->offset = session->total_queued_size; - j1939_session_skb_queue(session, skb); } + /* Session is ready, add it to skb queue and increase ref count. + */ + skcb->offset = session->total_queued_size; + j1939_session_skb_queue(session, skb); todo_size -= segment_size; session->total_queued_size += segment_size; diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 4be73de5033c..dd503bc3adb5 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1505,7 +1505,6 @@ static struct j1939_session *j1939_session_new(struct j1939_priv *priv, session->state = J1939_SESSION_NEW; skb_queue_head_init(&session->skb_queue); - skb_queue_tail(&session->skb_queue, skb); skcb = j1939_skb_to_cb(skb); memcpy(&session->skcb, skcb, sizeof(session->skcb)); @@ -1548,6 +1547,7 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv, kfree_skb(skb); return NULL; } + j1939_session_skb_queue(session, skb); /* alloc data area */ skb_put(skb, size); -- 2.43.0
