linux-cve-announce - CVE-2021-4454: can: j1939: fix errant WARN_ON_ONCE in j1939_session

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025032716-CVE-2021-4454-f4a4@gregkh>
Date: Thu, 27 Mar 2025 17:37:17 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-4454: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

The conclusion "j1939_session_deactivate() should be called with a
session ref-count of at least 2" is incorrect. In some concurrent
scenarios, j1939_session_deactivate can be called with the session
ref-count less than 2. But there is not any problem because it
will check the session active state before session putting in
j1939_session_deactivate_locked().

Here is the concurrent scenario of the problem reported by syzbot
and my reproduction log.

        cpu0                            cpu1
                                j1939_xtp_rx_eoma
j1939_xtp_rx_abort_one
                                j1939_session_get_by_addr [kref == 2]
j1939_session_get_by_addr [kref == 3]
j1939_session_deactivate [kref == 2]
j1939_session_put [kref == 1]
				j1939_session_completed
				j1939_session_deactivate
				WARN_ON_ONCE(kref < 2)

=====================================================
WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70
CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:j1939_session_deactivate+0x5f/0x70
Call Trace:
 j1939_session_deactivate_activate_next+0x11/0x28
 j1939_xtp_rx_eoma+0x12a/0x180
 j1939_tp_recv+0x4a2/0x510
 j1939_can_recv+0x226/0x380
 can_rcv_filter+0xf8/0x220
 can_receive+0x102/0x220
 ? process_backlog+0xf0/0x2c0
 can_rcv+0x53/0xf0
 __netif_receive_skb_one_core+0x67/0x90
 ? process_backlog+0x97/0x2c0
 __netif_receive_skb+0x22/0x80

The Linux kernel CVE team has assigned CVE-2021-4454 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4.138 with commit 7eef18c0479ba5d9f54fba30cd77c233ebca3eb1 and fixed in 5.4.232 with commit 6950df42a03c9ac9290503ced3f371199cb68fa9
	Issue introduced in 5.10.56 with commit 55dd22c5d029423f513fd849e633adf0e9c10d0c and fixed in 5.10.168 with commit b6d44072117bba057d50f7a2f96e5d070c65926d
	Issue introduced in 5.14 with commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 and fixed in 5.15.93 with commit 9ab896775f98ff54b68512f345eed178bf961084
	Issue introduced in 5.14 with commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 and fixed in 6.1.11 with commit 1740a1e45eee65099a92fb502e1e67e63aad277d
	Issue introduced in 5.14 with commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 and fixed in 6.2 with commit d0553680f94c49bbe0e39eb50d033ba563b4212d
	Issue introduced in 5.13.8 with commit 5e1fc537c1be332aef9621ca9146aeb3ba59522f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-4454
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/can/j1939/transport.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6950df42a03c9ac9290503ced3f371199cb68fa9
	https://git.kernel.org/stable/c/b6d44072117bba057d50f7a2f96e5d070c65926d
	https://git.kernel.org/stable/c/9ab896775f98ff54b68512f345eed178bf961084
	https://git.kernel.org/stable/c/1740a1e45eee65099a92fb502e1e67e63aad277d
	https://git.kernel.org/stable/c/d0553680f94c49bbe0e39eb50d033ba563b4212d