[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0000000000009e59f4060035f595@google.com>
Date: Tue, 11 Jul 2023 06:20:14 -0700
From: syzbot <syzbot+1591462f226d9cbf0564@...kaller.appspotmail.com>
To: hdanton@...a.com
Cc: hdanton@...a.com, linux-kernel@...r.kernel.org,
syzkaller@...glegroups.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [can?] possible deadlock in j1939_sk_errqueue (2)
> On Mon, 10 Jul 2023 10:53:57 -0700
>> HEAD commit: e40939bbfc68 Merge branch 'for-next/core' into for-kernelci
>> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=178f78d4a80000
>
> Put session without the session list lock held.
>
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git e40939bbfc68
Your commands are accepted, but please keep syzkaller-bugs@...glegroups.com mailing list in CC next time. It serves as a history of what happened with each bug report. Thank you.
>
> --- x/net/can/j1939/transport.c
> +++ y/net/can/j1939/transport.c
> @@ -1083,7 +1083,6 @@ static bool j1939_session_deactivate_loc
>
> list_del_init(&session->active_session_list_entry);
> session->state = J1939_SESSION_DONE;
> - j1939_session_put(session);
> }
>
> return active;
> @@ -1098,6 +1097,9 @@ static bool j1939_session_deactivate(str
> active = j1939_session_deactivate_locked(session);
> j1939_session_list_unlock(priv);
>
> + if (active)
> + j1939_session_put(session);
> +
> return active;
> }
>
> @@ -2178,6 +2180,7 @@ void j1939_simple_recv(struct j1939_priv
> int j1939_cancel_active_session(struct j1939_priv *priv, struct sock *sk)
> {
> struct j1939_session *session, *saved;
> + LIST_HEAD(active);
>
> netdev_dbg(priv->ndev, "%s, sk: %p\n", __func__, sk);
> j1939_session_list_lock(priv);
> @@ -2191,10 +2194,16 @@ int j1939_cancel_active_session(struct j
> j1939_session_put(session);
>
> session->err = ESHUTDOWN;
> - j1939_session_deactivate_locked(session);
> + if (j1939_session_deactivate_locked(session))
> + list_move(&session->active_session_list_entry, &active);
> }
> }
> j1939_session_list_unlock(priv);
> +
> + list_for_each_entry_safe(session, saved, &active, active_session_list_entry) {
> + list_del_init(&session->active_session_list_entry);
> + j1939_session_put(session);
> + }
> return NOTIFY_DONE;
> }
>
> --
Powered by blists - more mailing lists