CVE-2021-4454

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

The conclusion "j1939_session_deactivate() should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939_session_deactivate can be called with the session ref-count less than 2. But there is not any problem because it will check the session active state before session putting in j1939_session_deactivate_locked().

Here is the concurrent scenario of the problem reported by syzbot and my reproduction log.

    cpu0                            cpu1
                            j1939_xtp_rx_eoma

j1939_xtp_rx_abort_one j1939_session_get_by_addr [kref == 2] j1939_session_get_by_addr [kref == 3] j1939_session_deactivate [kref == 2] j1939_session_put [kref == 1] j1939_session_completed j1939_session_deactivate WARN_ON_ONCE(kref < 2)

===================================================== WARNING: CPU: 1 PID: 21 at net/can/j1939/transport.c:1088 j1939_session_deactivate+0x5f/0x70 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.14.0-rc7+ #32 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014 RIP: 0010:j1939_session_deactivate+0x5f/0x70 Call Trace: j1939_session_deactivate_activate_next+0x11/0x28 j1939_xtp_rx_eoma+0x12a/0x180 j1939_tp_recv+0x4a2/0x510 j1939_can_recv+0x226/0x380 can_rcv_filter+0xf8/0x220 can_receive+0x102/0x220 ? process_backlog+0xf0/0x2c0 can_rcv+0x53/0xf0 __netif_receive_skb_one_core+0x67/0x90 ? process_backlog+0x97/0x2c0 __netif_receive_skb+0x22/0x80

A low severity flaw was found in the Linux kernel's SAE J1939 CAN transport layer (net/can/j1939). Due to a race in session reference-count handling, concurrent J1939 transport processing (for example a session completing on one CPU while another session is aborted on another) can cause j1939_session_deactivate() to be invoked with a session reference count below the previously assumed minimum of 2, triggering an errant WARN_ON_ONCE warning in the kernel. Upstream analysis determined that this condition causes no functional problem beyond the warning, because the session's active state is checked before the session reference is released in j1939_session_deactivate_locked(). A local user with access to a system using the J1939 protocol could trigger this spurious kernel warning, with a low availability impact; there is no impact on confidentiality or integrity. Red Hat Product Security rated this flaw Low (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). The CVE.org record scores this issue as Important (7.5) using a network attack vector, which does not reflect the local nature of the defect, since the J1939 code path is only reachable through locally attached CAN networking. Red Hat Enterprise Linux 6, 7, 8, and 10 are not affected because the vulnerable code is not present in their kernels. In the affected Red Hat Enterprise Linux 9 and Red Hat In-Vehicle OS kernel builds, the fix is deferred: the flaw manifests only as a spurious kernel warning rather than memory corruption or data damage, so it is being addressed through the regular deferred-update process rather than an immediate update. The residual risk is limited to a kernel warning being triggered on systems actively using the J1939 CAN protocol.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.