can: j1939: j1939_can_recv(): add priv refcounting

j1939_can_recv() can be called in parallel with socket release. In this
case sk_release and sk_destruct can be done earlier than
j1939_can_recv() is processed.

Reported-by: [email protected]
Reported-by: [email protected]
Reported-by: [email protected]
Fixes: 9d71dd0 ("can: add support of SAE J1939 protocol")
Signed-off-by: Oleksij Rempel <[email protected]>

Author: olerem

net/can/j1939/main.c

@@ -51,6 +51,7 @@ static void j1939_can_recv(struct sk_buff *iskb, void *data)
 	if (!skb)
 		return;
 
+	j1939_priv_get(priv);
 	can_skb_set_owner(skb, iskb->sk);
 
 	/* get a pointer to the header of the skb
@@ -104,6 +105,7 @@ static void j1939_can_recv(struct sk_buff *iskb, void *data)
 	j1939_simple_recv(priv, skb);
 	j1939_sk_recv(priv, skb);
  done:
+	j1939_priv_put(priv);
 	kfree_skb(skb);
 }