From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7F67B1624DF for ; Mon, 6 Jul 2026 01:11:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783300304; cv=none; b=FWNK09vpGdO3dc1lHF4j1YjkBtHDnPp2B17y3sAh3EZjthVDbGx+cbdBCDJxR7nh62ER4QsVICiMw8z74jREkwbS8IHorrTFy0n0nBimxVALMk00JIKbikmwBsejhWHse7P5NrObasH4+8tjHQ5DQOHgcdWHafEMu4KN8H6eg+c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783300304; c=relaxed/simple; bh=qTRNoIJbKHT0QHsZMURwgzxLuogblRpKJJhn1hS9blg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U5rGM/bNAOvgrxqSFTD6cFbyDOpRh8oepvkiA7cVE9Ha3YyVAoWmtxnkCVVYkIueps5zqrBp+vzlhosNGS0Xx7dfCFkJ0tJa5IGIwXAL6an11rUjzpEDHeDBUZf0Qqcg8F3IpAUXeQZVRpmK3ApW2J0w3xdhbSK38/teyJp+mps= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=fE8IZaM+; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="fE8IZaM+" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc7e86e7aeso8724345ad.2 for ; Sun, 05 Jul 2026 18:11:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783300301; x=1783905101; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=5o+L6lvGahT9+d8C5f1+uKU+h4JTcYUYEJtTHHZwM/M=; b=fE8IZaM+8M5Bx2fDMwO/V/ccdVwmR8doI0mkogUobl2fRX++MAcH2j35A99Ez7AwVC vX5pn+fEEzESG/7nHcsZahE3AYIvwa6UjcjkKC5bHLGgTC7f1INWLlUBZ0hOh+O2vm18 tHWUAsNaaF/Sb1DOJueGwhvl29IMlrT2u7n9EtQmkBOQLEj5Asfj9xFCh7oMDfDwKcAM 3N+k6ld0oKph8wmJxJfToms8o5M9KgLY39kyBrQ7+GKEzkc1iUeSrL3qGOJN8aScPtNp mzQhfCx49Q001QbxEr0GpIrpmkgQeu4mysK1eA95B2Qe4zXlF0t8pdwm4X8NTC28EJ3q h3iA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783300301; x=1783905101; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=5o+L6lvGahT9+d8C5f1+uKU+h4JTcYUYEJtTHHZwM/M=; b=FkqEzSdEADTi6OqNL7vopzK0aYUtM2gObUvAu7C+nAOw1XI9JN3vRJi/rrCMxMkvZN PitK8uHGEKnUVg+KYsGkD3+0zyp5+sum4i7XQ0fgOGRglRr3PSvAMCQ+CY+68kwwB6/m 9mxTtUg0E9u1Y1FGzhLOkY2U/wzkC5zm6+nw/KrCN977zQWqwnUpeam1OELAwv20F1Rj qlDFHl3kCKQaBRYuXJaf47dB9UsmpotCGvNQgD9gvC3b3mF5Wx41qxy33uKWrpzi0nHf bSSTISF7WF87gvdfIpR3gezxMzSGoplOp89TlZSc3FW/ndb9OR/FHuBoD1Z6dOs4oPIC 4VhA== X-Forwarded-Encrypted: i=1; AHgh+Rob3geVLgo/3wIqCrilq7tq2j26RtPBvtodfnGQZryMKz/Lsklw9QgPceLWg8uIxhRWQY9lUDq4SfLTE0E=@vger.kernel.org X-Gm-Message-State: AOJu0YzFteo+tyYblrkysRyIItPBvsBdpHZmDdp1y3CJTWQeG88avoeJ LHJC+xSGKXb/f9jZh6AAMvpIr2lNmeTXx+Akbx8lpRKdist7JhCeilGP6GGi1XGI7w== X-Gm-Gg: AfdE7clf75wfUL3SK5t6VqbT47oTGa2rqIF0aY9I2owDnHc01J+4CrOcvcoUkX3tHC0 nL6XtjPW+YFAmfggsARTZLHj1UkhTYmnYdmjE5bq2gW8A/CdqCeVFNFfXW0ce3KLcA9Uwab891p 3e1zy0ljqVvClEdV9n2CG50Rtyv8Ct+Qs7KDpHIaaHo6tXz0mJo1HghZptlyaD2qd86zy8WJS8x NMTjdUOCvR0wg1QIQKtL8VZumqRnfqmPdl4iuwXdW6B2dNe0PCzLT1r4NH4lKF17WjXcJIhINml AUZEYnxElgopHn+4W7R7RLLa0s2Po2qttNfcsI1dXhuKY3RU+QB4ipMKXHTaL6BJyeL+Avy7gMN JNurVpZswRmCrdF9igH6nICf+lKqB9YkjcvnmAdzEYVomrF3mm7IASs7y2wk5WfUTFcBTaNtcjg == X-Received: by 2002:a17:903:b0c:b0:2c0:b6c7:227e with SMTP id d9443c01a7336-2cbb1e32ddamr76354655ad.5.1783300300884; Sun, 05 Jul 2026 18:11:40 -0700 (PDT) Received: from p1.. ([2607:fb91:1524:8834:f5c7:cf11:8d30:76f4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cad71478dfsm40167375ad.37.2026.07.05.18.11.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 05 Jul 2026 18:11:40 -0700 (PDT) From: Xiang Mei To: Robin van der Gracht , Oleksij Rempel , Oliver Hartkopp , Marc Kleine-Budde , kernel@pengutronix.de Cc: linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, bestswngs@gmail.com, Xiang Mei Subject: [PATCH net] can: j1939: zero the reassembly buffer to avoid uninitialized slab leak Date: Sun, 5 Jul 2026 18:11:31 -0700 Message-ID: <20260706011131.2445034-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit j1939_session_fresh_new() allocates the reassembly buffer with alloc_skb() and exposes its whole data area via skb_put(skb, size) without zeroing it. For non-ETP sessions j1939_xtp_rx_rts_session_new() sets pkt.total from an attacker-controlled byte of the RTS/BAM frame (session->pkt.total = dat[3]); a mismatch only warns and does not abort. A small pkt.total marks the message complete after only a few bytes are copied, and j1939_sk_recvmsg() delivers the full skb->len, leaking the untouched tail of the buffer as uninitialized slab memory. Zero the data area with skb_put_zero(). Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Reported-by: Weiming Shi Signed-off-by: Xiang Mei Assisted-by: Claude:claude-opus-4-8 --- net/can/j1939/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index df93d57907da..2e062f7d277d 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1568,7 +1568,7 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv, } /* alloc data area */ - skb_put(skb, size); + skb_put_zero(skb, size); /* skb is recounted in j1939_session_new() */ return session; } -- 2.43.0