[PATCH] can: j1939: fix transport session leak and socket bind/connect validation

[Hui Peng <benquike@gmail.com>]

Fix two issues in net/can/j1939/:

1. In j1939_tp_rxtimer() and session teardown
   (net/can/j1939/transport.c), ensure active transport sessions and
   skbs are properly cancelled and released on error or timeout.
2. In net/can/j1939/socket.c, validate socket state and address fields
   consistently across bind/connect/sendmsg.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 8fcfd13e5e6f..712bca1174d3 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1672,10 +1672,15 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv,
 	session->pkt.total = (len + 6) / 7;
 	session->pkt.block = 0xff;
 	if (skcb.addr.type != J1939_ETP) {
-		if (dat[3] != session->pkt.total)
+		if (dat[3] != session->pkt.total || !dat[4]) {
 			netdev_alert(priv->ndev, "%s: 0x%p: strange total, %u != %u\n",
 				     __func__, session, session->pkt.total,
 				     dat[3]);
+			j1939_session_put(session);
+			j1939_xtp_tx_abort(priv, &skcb, true,
+					   J1939_XTP_ABORT_FAULT, pgn);
+			return NULL;
+		}
 		session->pkt.total = dat[3];
 		session->pkt.block = min(dat[3], dat[4]);
 	}
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 1d4af472de4a..889d4718c46a 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -470,6 +470,10 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr_unsized *uaddr, in
 			ret = -EINVAL;
 			goto out_release_sock;
 		}
+		if (j1939_sock_pending_get(&jsk->sk)) {
+			ret = -EBUSY;
+			goto out_release_sock;
+		}
 
 		/* drop old references */
 		j1939_jsk_del(priv, jsk);