can isotp TxBuffer UAF

Vulnerability analysis

Summary: Use-after-free vulnerability in CAN ISOTP socket implementation due to race condition between sendmsg and release operations

Root Cause: Race condition between isotp_sendmsg() reading so->tx.buf and isotp_release() freeing it when wait_event_interruptible() is interrupted by a signal

Attack Surface: Local attack surface requiring ability to create CAN ISOTP sockets and send signals to interrupt socket operations

Fix Mechanism: Defers buffer deallocation from isotp_release() to isotp_sock_destruct() which runs after all socket operations complete, eliminating the race window

Details: The vulnerability occurs in the CAN ISOTP (ISO Transport Protocol) socket implementation when isotp_release() is interrupted by a signal during wait_event_interruptible(). The root cause is inadequate synchronization between isotp_sendmsg() and isotp_release() when accessing the shared so->tx.buf buffer. isotp_sendmsg() uses only cmpxchg() on so->tx.state for serialization, while isotp_release() waits for ISOTP_IDLE state before freeing so->tx.buf. If a signal interrupts the wait during socket close while tx.state is ISOTP_SENDING, the release function exits early, forces ISOTP_SHUTDOWN, and proceeds to kfree(so->tx.buf) while sendmsg may still be reading the buffer in isotp_fill_dataframe(). The fix moves the kfree() operations from isotp_release() to a new isotp_sock_destruct() function that executes during socket destruction, ensuring both sendmsg and release operations are complete before buffer deallocation.