michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
v6.18.6
linux/net
History
Tetsuo Handa 79dd3f1d9d can: j1939: make j1939_session_activate() fail if device is no longer registered 
[ Upstream commit 5d5602236f ]

syzbot is still reporting

  unregister_netdevice: waiting for vcan0 to become free. Usage count = 2

even after commit 93a27b5891 ("can: j1939: add missing calls in
NETDEV_UNREGISTER notification handler") was added. A debug printk() patch
found that j1939_session_activate() can succeed even after
j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER)
has completed.

Since j1939_cancel_active_session() is processed with the session list lock
held, checking ndev->reg_state in j1939_session_activate() with the session
list lock held can reliably close the race window.

Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/b9653191-d479-4c8b-8536-1326d028db5c@I-love.SAKURA.ne.jp
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2026-01-17 16:35:33 +01:00
..
6lowpan
net: replace ND_PRINTK with dynamic debug
2025-07-10 15:27:32 -07:00
9p
9p/trans_fd: p9_fd_request: kick rx thread if EPOLLIN
2025-09-19 16:34:51 +09:00
802
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
8021q
net: vlan: sync VLAN features with lower device
2025-10-31 17:42:35 -07:00
appletalk
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-07-24 11:10:46 -07:00
atm
net: atm: fix incorrect cleanup function call in error path
2025-11-20 18:09:49 -08:00
ax25
ax25: properly unshare skbs in ax25_kiss_rcv()
2025-09-03 17:06:30 -07:00
batman-adv
Merge tag 'batadv-net-pullrequest-20251024' of https://git.open-mesh.org/linux-merge
2025-10-27 18:00:54 -07:00
bluetooth
Bluetooth: MGMT: report BIS capability flags in supported settings
2026-01-08 10:16:44 +01:00
bpf
bpf: Fix reference count leak in bpf_prog_test_run_xdp()
2026-01-17 16:35:31 +01:00
bridge
bridge: fix C-VLAN preservation in 802.1ad vlan_tunnel egress
2026-01-17 16:35:22 +01:00
caif
caif: fix integer underflow in cffrml_receive()
2026-01-02 12:56:47 +01:00
can
can: j1939: make j1939_session_activate() fail if device is no longer registered
2026-01-17 16:35:33 +01:00
ceph
libceph: make calc_target() set t->paused, not just clear it
2026-01-17 16:35:15 +01:00
core
net: fix memory leak in skb_segment_list for GRO packets
2026-01-17 16:35:26 +01:00
dcb
Revert "Documentation: net: add flow control guide and document ethtool API"
2025-10-01 09:48:21 +02:00
devlink
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
2025-11-18 17:12:21 -08:00
dns_resolver
…
dsa
net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
2026-01-08 10:16:45 +01:00
ethernet
ethernet: Extend device_get_mac_address() to use NVMEM
2025-09-15 18:34:08 -07:00
ethtool
ethtool: Avoid overflowing userspace buffer on stats query
2026-01-02 12:56:48 +01:00
handshake
net/handshake: restore destructor on submit failure
2026-01-02 12:57:23 +01:00
hsr
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
2026-01-02 12:56:57 +01:00
ieee802154
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
ife
…
ipv4
arp: do not assume dev_hard_header() does not change skb->head
2026-01-17 16:35:30 +01:00
ipv6
erspan: Initialize options_len before referencing options.
2026-01-08 10:17:12 +01:00
iucv
net: add sk_drops_read(), sk_drops_inc() and sk_drops_reset() helpers
2025-08-28 13:14:50 +02:00
kcm
net: kcm: Fix race condition in kcm_unattach()
2025-08-13 18:18:33 -07:00
key
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-07-24 11:10:46 -07:00
l2tp
l2tp: reset skb control buffer on xmit
2025-11-20 11:52:24 +01:00
l3mdev
net: fib_rules: Fix iif / oif matching on L3 master device
2025-04-15 17:54:56 -07:00
lapb
treewide, timers: Rename from_timer() to timer_container_of()
2025-06-08 09:07:37 +02:00
llc
net: make sk->sk_rcvtimeo lockless
2025-06-23 17:05:12 -07:00
mac80211
wifi: mac80211: restore non-chanctx injection behaviour
2026-01-17 16:35:15 +01:00
mac802154
…
mctp
net: mctp: unconditionally set skb->dev on dst output
2025-11-27 11:39:12 +01:00
mpls
net: s/dev_get_flags/netif_get_flags/
2025-07-18 17:27:47 -07:00
mptcp
mptcp: ensure context reset on disconnect()
2026-01-11 15:26:19 +01:00
ncsi
net: ncsi: Fix buffer overflow in fetching version id
2025-06-12 18:21:59 -07:00
netfilter
netfilter: nf_tables: avoid chain re-validation if possible
2026-01-17 16:35:32 +01:00
netlabel
audit: add record for multiple task security contexts
2025-08-30 10:15:30 -04:00
netlink
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2025-09-11 17:40:13 -07:00
netrom
netrom: Fix memory leak in nr_sendmsg()
2026-01-02 12:56:43 +01:00
nfc
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
2026-01-08 10:17:14 +01:00
nsh
…
openvswitch
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
2026-01-08 10:16:44 +01:00
packet
net: af_packet: Use hrtimer to do the retire operation
2025-09-11 18:40:06 -07:00
phonet
net: add sk_drops_read(), sk_drops_inc() and sk_drops_reset() helpers
2025-08-28 13:14:50 +02:00
psample
…
psp
net: psp: don't assume reply skbs will have a socket
2025-10-03 10:23:50 -07:00
qrtr
…
rds
net: WQ_PERCPU added to alloc_workqueue users
2025-09-22 17:40:30 -07:00
rfkill
net: replace use of system_wq with system_percpu_wq
2025-09-22 17:40:30 -07:00
rose
net: rose: fix invalid array index in rose_kill_by_device()
2026-01-08 10:16:49 +01:00
rxrpc
net: WQ_PERCPU added to alloc_workqueue users
2025-09-22 17:40:30 -07:00
sched
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
2026-01-17 16:35:29 +01:00
sctp
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().
2025-12-18 14:02:41 +01:00
shaper
…
smc
net/smc: fix mismatch between CLC header and proposal
2025-11-10 17:52:09 -08:00
strparser
strparser: Fix signed/unsigned mismatch bug
2025-11-07 18:17:16 -08:00
sunrpc
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
2026-01-02 12:57:25 +01:00
switchdev
…
tipc
tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-11-10 18:14:40 -08:00
tls
net: tls: Cancel RX async resync request on rcd_delta overflow
2025-10-29 18:32:18 -07:00
unix
net: do not write to msg_get_inq in callee
2026-01-17 16:35:11 +01:00
vmw_vsock
vsock: Make accept()ed sockets use custom setsockopt()
2026-01-17 16:35:25 +01:00
wireless
wifi: avoid kernel-infoleak from struct iw_point
2026-01-17 16:35:14 +01:00
x25
net/x25: Remove unused x25_terminate_link()
2025-07-14 17:19:13 -07:00
xdp
xsk: avoid data corruption on cq descriptor number
2025-11-25 19:51:50 -08:00
xfrm
Merge tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
2025-11-18 17:58:44 -08:00
compat.c
…
devres.c
…
Kconfig
dibs: Create drivers/dibs
2025-09-23 11:13:21 +02:00
Kconfig.debug
…
Makefile
psp: base PSP device support
2025-09-18 12:32:06 +02:00
socket.c
Merge tag 'net-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2025-10-02 15:17:01 -07:00
sysctl_net.c
…