CVE-2021-4454

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

The conclusion "j1939_session_deactivate() should be called with a

session ref-count of at least 2" is incorrect. In some concurrent

scenarios, j1939_session_deactivate can be called with the session

ref-count less than 2. But there is not any problem because it

will check the session active state before session putting in

j1939_session_deactivate_locked().

Here is the concurrent scenario of the problem reported by syzbot

and my reproduction log.

cpu0 cpu1

j1939_xtp_rx_eoma

j1939_xtp_rx_abort_one

j1939_session_get_by_addr [kref == 2]

j1939_session_get_by_addr [kref == 3]

j1939_session_deactivate [kref == 2]

j1939_session_put [kref == 1]

j1939_session_completed

j1939_session_deactivate

WARN_ON_ONCE(kref < 2)

===================================

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References