[PATCH] can: j1939: fix NULL pointer dereference in j1939_session_completed()

[Weiming Shi <bestswngs@gmail.com>]

j1939_xtp_rx_dpo_one() accepts an attacker-controlled DPO value
without bounds checking. When DPO >= session->pkt.total, the
subsequent j1939_session_skb_get() returns NULL, and
j1939_session_completed() passes it to j1939_sk_recv() which
dereferences oskb->sk, causing a kernel panic.

 Oops: general protection fault, 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
 RIP: 0010:j1939_sk_recv (socket.c:318 socket.c:363)
 Call Trace:
  <IRQ>
  j1939_xtp_rx_eoma (transport.c:1235 transport.c:1412)
  j1939_tp_recv (transport.c:2141 transport.c:2189)
  j1939_can_recv (main.c:108)

Validate DPO against session->pkt.total in j1939_xtp_rx_dpo_one()
and abort the session if out of bounds. Also add a NULL guard in
j1939_session_completed() as defense in depth.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 net/can/j1939/transport.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index df93d57907da..9b0d67c8a9a0 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1231,9 +1231,11 @@ static void j1939_session_completed(struct j1939_session *session)
 
 	if (!session->transmission) {
 		se_skb = j1939_session_skb_get(session);
-		/* distribute among j1939 receivers */
-		j1939_sk_recv(session->priv, se_skb);
-		consume_skb(se_skb);
+		if (se_skb) {
+			/* distribute among j1939 receivers */
+			j1939_sk_recv(session->priv, se_skb);
+			consume_skb(se_skb);
+		}
 	}
 
 	j1939_session_deactivate_activate_next(session);
@@ -1818,6 +1820,11 @@ static void j1939_xtp_rx_dpo_one(struct j1939_session *session,
 
 	/* transmitted without problems */
 	session->pkt.dpo = j1939_etp_ctl_to_packet(skb->data);
+	if (session->pkt.dpo >= session->pkt.total) {
+		j1939_session_timers_cancel(session);
+		j1939_session_cancel(session, J1939_XTP_ABORT_FAULT);
+		return;
+	}
 	session->last_cmd = dat[0];
 	j1939_tp_set_rxtimeout(session, 750);
 
-- 
2.43.0