mirror of
https://github.com/torvalds/linux.git
synced 2024-12-13 06:32:50 +00:00
2b17c400ae
A race condition was found in isotp_setsockopt() which allows to
change socket options after the socket was bound.
For the specific case of SF_BROADCAST support, this might lead to possible
use-after-free because can_rx_unregister() is not called.
Checking for the flag under the socket lock in isotp_bind() and taking
the lock in isotp_setsockopt() fixes the issue.
Fixes:
|
||
---|---|---|
.. | ||
j1939 | ||
af_can.c | ||
af_can.h | ||
bcm.c | ||
gw.c | ||
isotp.c | ||
Kconfig | ||
Makefile | ||
proc.c | ||
raw.c |