linux/net at linux-5.15.y - linux - Gitea: Git with a cup of tea

michael/linux

Files

History

Tetsuo Handa c3a4316e3c can: j1939: make j1939_session_activate() fail if device is no longer registered

[ Upstream commit 5d5602236f ]

syzbot is still reporting

  unregister_netdevice: waiting for vcan0 to become free. Usage count = 2

even after commit 93a27b5891 ("can: j1939: add missing calls in
NETDEV_UNREGISTER notification handler") was added. A debug printk() patch
found that j1939_session_activate() can succeed even after
j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER)
has completed.

Since j1939_cancel_active_session() is processed with the session list lock
held, checking ndev->reg_state in j1939_session_activate() with the session
list lock held can reliably close the race window.

Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/b9653191-d479-4c8b-8536-1326d028db5c@I-love.SAKURA.ne.jp
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-01-19 13:10:19 +01:00

..

…

net/9p: fix double req put in p9_fd_cancelled

2025-10-19 16:21:28 +02:00

net: 802: LLC+SNAP OID:PID lookup on start of skb data

2025-01-23 17:15:49 +01:00

net: vlan: sync VLAN features with lower device

2025-12-07 06:09:26 +09:00

net: appletalk: Fix use-after-free in AARP proxy probe

2025-08-28 16:24:04 +02:00

net: atm: fix memory leak in atm_register_sysfs when device_register fail

2025-09-09 18:50:20 +02:00

ax25: properly unshare skbs in ax25_kiss_rcv()

2025-09-09 18:50:20 +02:00

batman-adv: fix OOB read/write in network-coding decode

2025-09-09 18:50:21 +02:00

Bluetooth: Add more enc key size check

2025-12-07 06:09:36 +09:00

…

…

bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress

2026-01-19 13:10:16 +01:00

caif: fix integer underflow in cffrml_receive()

2026-01-19 13:09:44 +01:00

can: j1939: make j1939_session_activate() fail if device is no longer registered

2026-01-19 13:10:19 +01:00

libceph: make calc_target() set t->paused, not just clear it

2026-01-19 13:10:14 +01:00

net: sock: fix hardened usercopy panic in sock_recv_errqueue

2026-01-19 13:10:16 +01:00

…

net: fix data-races around sk->sk_forward_alloc

2025-01-23 17:16:04 +01:00

…

net: dsa: tag_brcm: legacy: fix untagged rx on unbridged ports for bcm63xx

2025-12-07 06:09:25 +09:00

…

net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()

2026-01-19 13:10:13 +01:00

net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()

2026-01-19 13:09:46 +01:00

net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()

2024-12-14 19:51:37 +01:00

…

arp: do not assume dev_hard_header() does not change skb->head

2026-01-19 13:10:17 +01:00

ipv6: Fix potential uninit-value access in __ip6_make_skb()

2026-01-19 13:10:12 +01:00

…

…

Revert "xfrm: destroy xfrm_state synchronously on net exit path"

2026-01-19 13:09:18 +01:00

…

…

…

llc: fix data loss when reading from a socket in llc_ui_recvmsg()

2025-06-04 14:38:06 +02:00

wifi: mac80211: Discard Beacon frames to non-broadcast address

2026-01-19 13:10:11 +01:00

mac802154: check local interfaces before deleting sdata list

2025-01-23 17:16:00 +01:00

net: mctp: Prevent duplicate binds

2025-08-28 16:24:20 +02:00

mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().

2025-06-27 11:05:36 +01:00

mptcp: pm: ignore unknown endpoint flags

2026-01-19 13:10:07 +01:00

net: ncsi: Fix buffer overflow in fetching version id

2025-08-28 16:24:22 +02:00

netfilter: nf_conncount: update last_gc only when GC has been performed

2026-01-19 13:10:16 +01:00

calipso: unlock rcu before returning -EAFNOSUPPORT

2025-06-27 11:05:22 +01:00

netlink: avoid infinite retry looping in netlink_unicast()

2025-08-28 16:24:15 +02:00

netrom: Fix memory leak in nr_sendmsg()

2026-01-19 13:09:43 +01:00

net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write

2026-01-19 13:10:03 +01:00

…

net: openvswitch: Avoid needlessly taking the RTNL on vport destroy

2026-01-19 13:09:56 +01:00

net/packet: fix a race in packet_set_ring() and packet_notifier()

2025-08-28 16:24:14 +02:00

phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()

2025-08-28 16:23:59 +02:00

…

…

rds: Fix endianness annotation for RDS_MPATH_HASH

2025-12-07 06:09:19 +09:00

net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer

2025-10-02 13:39:09 +02:00

net: rose: fix invalid array index in rose_kill_by_device()

2026-01-19 13:09:58 +01:00

rxrpc: Fix oops due to non-existence of prealloc backlog struct

2025-07-17 18:30:48 +02:00

net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset

2026-01-19 13:10:17 +01:00

sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().

2026-01-19 13:09:24 +01:00

net/smc: fix mismatch between CLC header and proposal

2025-12-07 06:09:27 +09:00

strparser: Fix signed/unsigned mismatch bug

2025-12-07 06:09:29 +09:00

SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

2026-01-19 13:10:08 +01:00

…

tipc: Fix use-after-free in tipc_mon_reinit_self().

2025-12-07 06:09:27 +09:00

net: tls: Cancel RX async resync request on rcd_delta overflow

2025-12-07 06:09:31 +09:00

af_unix: Don't leave consecutive consumed OOB skbs.

2025-10-02 13:39:14 +02:00

vsock: Ignore signal/timeout on connect() if already established

2025-12-07 06:09:31 +09:00

wifi: avoid kernel-infoleak from struct iw_point

2026-01-19 13:10:14 +01:00

…

xsk: fix OOB map writes when deleting elements

2024-12-14 19:51:33 +01:00

xfrm: flush all states in xfrm_state_fini

2026-01-19 13:09:19 +01:00

compat.c

…

devres.c

…

Kconfig

…

Makefile

…

socket.c

net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

2026-01-19 13:10:11 +01:00

sysctl_net.c

…