michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
linux-6.18.y
linux/net
History
Tetsuo Handa 6121b7564c net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts 
commit 1809c82aa0 upstream.

Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is
called only when the timer is enabled, we need to call
j1939_session_deactivate_activate_next() if we cancelled the timer.
Otherwise, refcount for j1939_session leaks, which will later appear as

| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.

problem.

Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol")
Link: https://patch.msgid.link/b1212653-8fa1-44e1-be9d-12f950fb3a07@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-23 11:21:24 +01:00
..
6lowpan
…
9p
…
802
…
8021q
net: vlan: sync VLAN features with lower device
2025-10-31 17:42:35 -07:00
appletalk
…
atm
net: atm: fix incorrect cleanup function call in error path
2025-11-20 18:09:49 -08:00
ax25
…
batman-adv
…
bluetooth
Bluetooth: hci_sync: enable PA Sync Lost event
2026-01-23 11:21:15 +01:00
bpf
bpf: Fix reference count leak in bpf_prog_test_run_xdp()
2026-01-17 16:35:31 +01:00
bridge
net: bridge: annotate data-races around fdb->{updated,used}
2026-01-23 11:21:16 +01:00
caif
caif: fix integer underflow in cffrml_receive()
2026-01-02 12:56:47 +01:00
can
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
2026-01-23 11:21:24 +01:00
ceph
libceph: make calc_target() set t->paused, not just clear it
2026-01-17 16:35:15 +01:00
core
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
2026-01-23 11:21:18 +01:00
dcb
…
devlink
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
2025-11-18 17:12:21 -08:00
dns_resolver
…
dsa
net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
2026-01-08 10:16:45 +01:00
ethernet
…
ethtool
ethtool: Avoid overflowing userspace buffer on stats query
2026-01-02 12:56:48 +01:00
handshake
net/handshake: restore destructor on submit failure
2026-01-02 12:57:23 +01:00
hsr
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
2026-01-02 12:56:57 +01:00
ieee802154
…
ife
…
ipv4
dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
2026-01-23 11:21:18 +01:00
ipv6
ipv6: Fix use-after-free in inet6_addr_del().
2026-01-23 11:21:18 +01:00
iucv
…
kcm
…
key
…
l2tp
l2tp: reset skb control buffer on xmit
2025-11-20 11:52:24 +01:00
l3mdev
…
lapb
…
llc
…
mac80211
wifi: mac80211: restore non-chanctx injection behaviour
2026-01-17 16:35:15 +01:00
mac802154
…
mctp
net: mctp: unconditionally set skb->dev on dst output
2025-11-27 11:39:12 +01:00
mpls
…
mptcp
mptcp: ensure context reset on disconnect()
2026-01-11 15:26:19 +01:00
ncsi
…
netfilter
netfilter: nf_tables: avoid chain re-validation if possible
2026-01-17 16:35:32 +01:00
netlabel
…
netlink
…
netrom
netrom: Fix memory leak in nr_sendmsg()
2026-01-02 12:56:43 +01:00
nfc
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
2026-01-08 10:17:14 +01:00
nsh
…
openvswitch
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
2026-01-08 10:16:44 +01:00
packet
…
phonet
…
psample
…
psp
…
qrtr
…
rds
…
rfkill
…
rose
net: rose: fix invalid array index in rose_kill_by_device()
2026-01-08 10:16:49 +01:00
rxrpc
…
sched
net/sched: sch_qfq: do not free existing class in qfq_change_class()
2026-01-23 11:21:18 +01:00
sctp
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
2025-12-18 14:02:41 +01:00
shaper
…
smc
net/smc: fix mismatch between CLC header and proposal
2025-11-10 17:52:09 -08:00
strparser
strparser: Fix signed/unsigned mismatch bug
2025-11-07 18:17:16 -08:00
sunrpc
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
2026-01-02 12:57:25 +01:00
switchdev
…
tipc
tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-11-10 18:14:40 -08:00
tls
…
unix
net: do not write to msg_get_inq in callee
2026-01-17 16:35:11 +01:00
vmw_vsock
vsock: Make accept()ed sockets use custom setsockopt()
2026-01-17 16:35:25 +01:00
wireless
wifi: avoid kernel-infoleak from struct iw_point
2026-01-17 16:35:14 +01:00
x25
…
xdp
xsk: avoid data corruption on cq descriptor number
2025-11-25 19:51:50 -08:00
xfrm
xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
2026-01-23 11:21:13 +01:00
compat.c
…
devres.c
…
Kconfig
…
Kconfig.debug
…
Makefile
…
socket.c
…
sysctl_net.c
…