netdev - can: j1939: unregister_netdevice: waiting for vcan0 to become free.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <faee3f3c-b03d-4937-9202-97ec5920d699@I-love.SAKURA.ne.jp>
Date: Mon, 12 Jan 2026 23:51:57 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Robin van der Gracht <robin@...tonic.nl>,
        Oleksij Rempel <o.rempel@...gutronix.de>, kernel@...gutronix.de,
        Oliver Hartkopp <socketcan@...tkopp.net>,
        Marc Kleine-Budde <mkl@...gutronix.de>, linux-can@...r.kernel.org
Cc: Network Development <netdev@...r.kernel.org>
Subject: can: j1939: unregister_netdevice: waiting for vcan0 to become free.

Hello.

I found a simplified C reproducer for
https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 from

  r1 = socket$can_j1939(0x1d, 0x2, 0x7)
  ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000001440)={'vcan0\x00', <r2=>0x0})
  r3 = socket$can_j1939(0x1d, 0x2, 0x7)
  ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vcan0\x00', <r4=>0x0})
  bind$can_j1939(r3, &(0x7f0000000340)={0x1d, r4, 0x0, {0x2, 0x0, 0x6}, 0xfe}, 0x18)
  setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
  sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081)
  bind$can_j1939(r1, &(0x7f0000000100)={0x1d, r2, 0x0, {0x1, 0xf0, 0x4}, 0xfe}, 0x18)
  setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
  sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000000)="81b641f1f3843704b6", 0x9}], 0x1}, 0x48005)

lines. Can you find what is wrong?

  [   58.844267] [   T1225] CAN device driver interface
  [   58.865035] [   T1225] vcan: Virtual CAN interface driver
  [   58.924043] [   T1227] can: controller area network core
  [   58.929503] [   T1227] NET: Registered PF_CAN protocol family
  [   58.959118] [   T1228] can: SAE J1939
  [   59.215990] [      C0] vcan0: j1939_tp_rxtimer: 0x0000000042028812: rx timeout, send abort
  [   59.716693] [      C0] vcan0: j1939_tp_rxtimer: 0x0000000041105737: rx timeout, send abort
  [   59.722127] [      C0] vcan0: j1939_tp_rxtimer: 0x0000000042028812: abort rx timeout. Force session deactivation
  [   59.742525] [      C0] vcan0: j1939_xtp_rx_rts_session_active: 0x0000000041105737: connection exists (fe ff). last cmd: 20
  [   59.992638] [      C0] vcan0: j1939_tp_rxtimer: 0x0000000069d7bfc6: rx timeout, send abort
  [   60.497771] [      C0] vcan0: j1939_tp_rxtimer: 0x0000000069d7bfc6: abort rx timeout. Force session deactivation
  [   70.677761] [     T12] unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
View attachment "repro.c" of type "text/plain" (2728 bytes)