[PATCH net] can: j1939: zero the reassembly buffer to avoid uninitialized slab leak

[Xiang Mei <xmei5@asu.edu>]

j1939_session_fresh_new() allocates the reassembly buffer with alloc_skb()
and exposes its whole data area via skb_put(skb, size) without zeroing it.

For non-ETP sessions j1939_xtp_rx_rts_session_new() sets pkt.total from an
attacker-controlled byte of the RTS/BAM frame (session->pkt.total =
dat[3]); a mismatch only warns and does not abort. A small pkt.total marks
the message complete after only a few bytes are copied, and
j1939_sk_recvmsg() delivers the full skb->len, leaking the untouched tail
of the buffer as uninitialized slab memory.

Zero the data area with skb_put_zero().

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
---
 net/can/j1939/transport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index df93d57907da..2e062f7d277d 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1568,7 +1568,7 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv,
 	}
 
 	/* alloc data area */
-	skb_put(skb, size);
+	skb_put_zero(skb, size);
 	/* skb is recounted in j1939_session_new() */
 	return session;
 }
-- 
2.43.0