can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv

JIRA: https://issues.redhat.com/browse/RHEL-38415
CVE: CVE-2021-47459

commit d9d52a3
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Sun Sep 26 18:47:57 2021 +0800

    can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv

    It will trigger UAF for rx_kref of j1939_priv as following.

            cpu0                                    cpu1
    j1939_sk_bind(socket0, ndev0, ...)
    j1939_netdev_start
                                            j1939_sk_bind(socket1, ndev0, ...)
                                            j1939_netdev_start
    j1939_priv_set
                                            j1939_priv_get_by_ndev_locked
    j1939_jsk_add
    .....
    j1939_netdev_stop
    kref_put_lock(&priv->rx_kref, ...)
                                            kref_get(&priv->rx_kref, ...)
                                            REFCOUNT_WARN("addition on 0;...")

    ====================================================
    refcount_t: addition on 0; use-after-free.
    WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
    RIP: 0010:refcount_warn_saturate+0x169/0x1e0
    Call Trace:
     j1939_netdev_start+0x68b/0x920
     j1939_sk_bind+0x426/0xeb0
     ? security_socket_bind+0x83/0xb0

    The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
    protect.

    Fixes: 9d71dd0 ("can: add support of SAE J1939 protocol")
    Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
    Cc: stable@vger.kernel.org
    Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
    Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
    Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Ken Cox <jkc@redhat.com>

Author: Ken Cox

net/can/j1939/main.c

@@ -253,11 +253,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
 	struct j1939_priv *priv, *priv_new;
 	int ret;
 
-	priv = j1939_priv_get_by_ndev(ndev);
+	spin_lock(&j1939_netdev_lock);
+	priv = j1939_priv_get_by_ndev_locked(ndev);
 	if (priv) {
 		kref_get(&priv->rx_kref);
+		spin_unlock(&j1939_netdev_lock);
 		return priv;
 	}
+	spin_unlock(&j1939_netdev_lock);
 
 	priv = j1939_priv_create(ndev);
 	if (!priv)
@@ -273,10 +276,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
 		/* Someone was faster than us, use their priv and roll
 		 * back our's.
 		 */
+		kref_get(&priv_new->rx_kref);
 		spin_unlock(&j1939_netdev_lock);
 		dev_put(ndev);
 		kfree(priv);
-		kref_get(&priv_new->rx_kref);
 		return priv_new;
 	}
 	j1939_priv_set(ndev, priv);