michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
04218cd68d1502000823c8288f37b4f171dcdcae
linux/net
History
Tetsuo Handa cb2a610867 net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts 
commit 1809c82aa0 upstream.

Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is
called only when the timer is enabled, we need to call
j1939_session_deactivate_activate_next() if we cancelled the timer.
Otherwise, refcount for j1939_session leaks, which will later appear as

| unregister_netdevice: waiting for vcan0 to become free. Usage count = 2.

problem.

Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol")
Link: https://patch.msgid.link/b1212653-8fa1-44e1-be9d-12f950fb3a07@I-love.SAKURA.ne.jp
Cc: stable@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-23 11:18:43 +01:00
..
6lowpan
ipv6: eliminate ndisc_ops_is_useropt()
2024-08-12 17:23:57 -07:00
9p
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
2025-11-13 15:34:34 -05:00
802
net: 802: LLC+SNAP OID:PID lookup on start of skb data
2025-01-17 13:40:37 +01:00
8021q
net: vlan: sync VLAN features with lower device
2025-11-13 15:34:37 -05:00
appletalk
net: appletalk: Fix use-after-free in AARP proxy probe
2025-08-01 09:48:41 +01:00
atm
net: atm: fix memory leak in atm_register_sysfs when device_register fail
2025-09-09 18:58:13 +02:00
ax25
ax25: properly unshare skbs in ax25_kiss_rcv()
2025-09-09 18:58:13 +02:00
batman-adv
batman-adv: fix OOB read/write in network-coding decode
2025-09-09 18:58:18 +02:00
bluetooth
tty: introduce and use tty_port_tty_vhangup() helper
2026-01-08 10:14:56 +01:00
bpf
bpf: test_run: Fix ctx leak in bpf_prog_test_run_xdp error path
2026-01-17 16:31:29 +01:00
bridge
bridge: mcast: Fix use-after-free during router port configuration
2026-01-23 11:18:42 +01:00
caif
caif: fix integer underflow in cffrml_receive()
2026-01-08 10:14:01 +01:00
can
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
2026-01-23 11:18:43 +01:00
ceph
libceph: make calc_target() set t->paused, not just clear it
2026-01-17 16:31:18 +01:00
core
net: update netdev_lock_{type,name}
2026-01-23 11:18:37 +01:00
dcb
…
dccp
dccp: Fix memory leak in dccp_feat_change_recv
2024-12-14 20:03:05 +01:00
devlink
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
2025-12-01 11:43:33 +01:00
dns_resolver
…
dsa
net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
2026-01-08 10:14:33 +01:00
ethernet
ethernet: Extend device_get_mac_address() to use NVMEM
2025-11-13 15:34:25 -05:00
ethtool
ethtool: Avoid overflowing userspace buffer on stats query
2026-01-08 10:14:02 +01:00
handshake
net/handshake: restore destructor on submit failure
2026-01-08 10:14:24 +01:00
hsr
hsr: hold rcu and dev lock for hsr_get_port_ndev
2026-01-08 10:14:27 +01:00
ieee802154
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
2024-12-14 20:03:47 +01:00
ife
…
ipv4
ipv4: ip_gre: make ipgre_header() robust
2026-01-23 11:18:37 +01:00
ipv6
ipv6: Fix use-after-free in inet6_addr_del().
2026-01-23 11:18:39 +01:00
iucv
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
2024-12-05 14:02:31 +01:00
kcm
net: kcm: Fix race condition in kcm_unattach()
2025-08-20 18:30:18 +02:00
key
Revert "xfrm: destroy xfrm_state synchronously on net exit path"
2025-12-12 18:37:17 +01:00
l2tp
l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
2025-09-04 15:31:51 +02:00
l3mdev
…
lapb
…
llc
llc: fix data loss when reading from a socket in llc_ui_recvmsg()
2025-05-29 11:03:20 +02:00
mac80211
wifi: mac80211: restore non-chanctx injection behaviour
2026-01-17 16:31:17 +01:00
mac802154
mac802154: check local interfaces before deleting sdata list
2025-01-23 17:22:54 +01:00
mctp
mctp: return -ENOPROTOOPT for unknown getsockopt options
2025-09-09 18:58:13 +02:00
mpls
mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
2025-06-27 11:11:43 +01:00
mptcp
mptcp: ensure context reset on disconnect()
2026-01-11 15:25:20 +01:00
ncsi
net: ncsi: Fix buffer overflow in fetching version id
2025-08-20 18:30:38 +02:00
netfilter
netfilter: nf_tables: avoid chain re-validation if possible
2026-01-17 16:31:28 +01:00
netlabel
calipso: unlock rcu before returning -EAFNOSUPPORT
2025-06-19 15:32:37 +02:00
netlink
genetlink: fix genl_bind() invoking bind() after -EPERM
2025-09-19 16:35:48 +02:00
netrom
netrom: Fix memory leak in nr_sendmsg()
2026-01-08 10:13:59 +01:00
nfc
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
2026-01-08 10:14:51 +01:00
nsh
…
openvswitch
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
2026-01-08 10:14:32 +01:00
packet
net/packet: fix a race in packet_set_ring() and packet_notifier()
2025-08-15 12:14:09 +02:00
phonet
phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
2025-07-24 08:56:24 +02:00
psample
psample: adjust size if rate_as_probability is set
2024-12-27 14:02:06 +01:00
qrtr
net: qrtr: Update packets cloning when broadcasting
2024-09-24 10:48:16 +02:00
rds
rds: Fix endianness annotation for RDS_MPATH_HASH
2025-11-13 15:34:15 -05:00
rfkill
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
2025-09-25 11:13:47 +02:00
rose
net: rose: fix invalid array index in rose_kill_by_device()
2026-01-08 10:14:35 +01:00
rxrpc
rxrpc: Fix transmission of an abort in response to an abort
2025-07-24 08:56:35 +02:00
sched
net/sched: sch_qfq: do not free existing class in qfq_change_class()
2026-01-23 11:18:39 +01:00
sctp
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
2025-12-18 13:54:48 +01:00
smc
net/smc: fix mismatch between CLC header and proposal
2025-11-24 10:35:50 +01:00
strparser
strparser: Fix signed/unsigned mismatch bug
2025-11-24 10:35:59 +01:00
sunrpc
svcrdma: bound check rq_pages index in inline path
2026-01-08 10:14:58 +01:00
switchdev
net: switchdev: Convert blocking notification chain to a raw one
2025-03-22 12:54:12 -07:00
tipc
tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-11-24 10:35:51 +01:00
tls
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
2026-01-17 16:31:18 +01:00
unix
af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic().
2025-12-01 11:43:34 +01:00
vmw_vsock
vsock: Make accept()ed sockets use custom setsockopt()
2026-01-17 16:31:24 +01:00
wireless
wifi: avoid kernel-infoleak from struct iw_point
2026-01-17 16:31:17 +01:00
x25
…
xdp
xsk: Harden userspace-supplied xdp_desc validation
2025-10-19 16:33:53 +02:00
xfrm
xfrm: set ipv4 no_pmtu_disc flag only on output sa when direction is set
2026-01-23 11:18:35 +01:00
compat.c
…
devres.c
…
Kconfig
memory-provider: disable building dmabuf mp on !CONFIG_PAGE_POOL
2024-09-13 11:41:45 -07:00
Kconfig.debug
…
Makefile
…
socket.c
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
2026-01-11 15:25:21 +01:00
sysctl_net.c
…