pull-request: can 2021-06-19

[Marc Kleine-Budde <mkl@pengutronix.de>]

Hello Jakub, hello David,

this is a pull request of 5 patches for net/master.

The first patch is by Thadeu Lima de Souza Cascardo and fixes a
potential use-after-free in the CAN broadcast manager socket, by
delaying the release of struct bcm_op after synchronize_rcu().

Oliver Hartkopp's patch fixes a similar potential user-after-free in
the CAN gateway socket by synchronizing RCU operations before removing
gw job entry.

Another patch by Oliver Hartkopp fixes a potential use-after-free in
the ISOTP socket by omitting unintended hrtimer restarts on socket
release.

Oleksij Rempel's patch for the j1939 socket fixes a potential
use-after-free by setting the SOCK_RCU_FREE flag on the socket.

The last patch is by Pavel Skripkin and fixes a use-after-free in the
ems_usb CAN driver.

All patches are intended for stable and have stable@v.k.o on Cc.

regards,
Marc

---

The following changes since commit dda2626b86c2c1813b7bfdd10d2fdd849611fc97:

  Merge branch 'ezchip-fixes' (2021-06-19 11:46:24 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can.git tags/linux-can-fixes-for-5.13-20210619

for you to fetch changes up to ab4a0b8fcb9a95c02909b62049811bd2e586aaa4:

  net: can: ems_usb: fix use-after-free in ems_usb_disconnect() (2021-06-19 23:54:00 +0200)

----------------------------------------------------------------
linux-can-fixes-for-5.13-20210619

----------------------------------------------------------------
Oleksij Rempel (1):
      can: j1939: j1939_sk_init(): set SOCK_RCU_FREE to call sk_destruct() after RCU is done

Oliver Hartkopp (2):
      can: gw: synchronize rcu operations before removing gw job entry
      can: isotp: isotp_release(): omit unintended hrtimer restart on socket release

Pavel Skripkin (1):
      net: can: ems_usb: fix use-after-free in ems_usb_disconnect()

Thadeu Lima de Souza Cascardo (1):
      can: bcm: delay release of struct bcm_op after synchronize_rcu()

 drivers/net/can/usb/ems_usb.c | 3 ++-
 net/can/bcm.c                 | 7 ++++++-
 net/can/gw.c                  | 3 +++
 net/can/isotp.c               | 7 ++++---
 net/can/j1939/main.c          | 4 ++++
 net/can/j1939/socket.c        | 3 +++
 6 files changed, 22 insertions(+), 5 deletions(-)