netdev - Re: can: j1939: unregister_netdevice: waiting for vcan0 to become free.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4b1fbe9d-5ca2-41e9-b252-1304cc7c215a@I-love.SAKURA.ne.jp>
Date: Tue, 13 Jan 2026 12:46:30 +0900
From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To: Robin van der Gracht <robin@...tonic.nl>,
        Oleksij Rempel <o.rempel@...gutronix.de>, kernel@...gutronix.de,
        Oliver Hartkopp <socketcan@...tkopp.net>,
        Marc Kleine-Budde <mkl@...gutronix.de>, linux-can@...r.kernel.org
Cc: Network Development <netdev@...r.kernel.org>
Subject: Re: can: j1939: unregister_netdevice: waiting for vcan0 to become
 free.

Currently, the (session->last_cmd != 0) path in j1939_xtp_rx_rts_session_active() is
preventing the (session->state == J1939_SESSION_WAITING_ABORT) path in j1939_tp_rxtimer()
 from being called. This results in two j1939_priv refcounts leak (which in turn results in
one net_device refcount leak) due to j1939_session_deactivate_activate_next() being not called.

This problem goes away if I do either

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1689,16 +1692,18 @@ static int j1939_xtp_rx_rts_session_active(struct j1939_session *session,

        if (session->last_cmd != 0) {
                /* we received a second rts on the same connection */
-               netdev_alert(priv->ndev, "%s: 0x%p: connection exists (%02x %02x). last cmd: %x\n",
+               netdev_alert(priv->ndev, "%s (modified): 0x%p: connection exists (%02x %02x). last cmd: %x\n",
                             __func__, session, skcb->addr.sa, skcb->addr.da,
                             session->last_cmd);

+               /*
                j1939_session_timers_cancel(session);
                j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
                if (session->transmission)
                        j1939_session_deactivate_activate_next(session);

                return -EBUSY;
+               */
        }

        if (session->skcb.addr.sa != skcb->addr.sa ||

or

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1697,6 +1700,11 @@ static int j1939_xtp_rx_rts_session_active(struct j1939_session *session,
                j1939_session_cancel(session, J1939_XTP_ABORT_BUSY);
                if (session->transmission)
                        j1939_session_deactivate_activate_next(session);
+               else if (session->state == J1939_SESSION_WAITING_ABORT) {
+                       netdev_alert(priv->ndev, "%s (modified): 0x%p: abort rx timeout. Force session deactivation\n",
+                                    __func__, session);
+                       j1939_session_deactivate_activate_next(session);
+               }

                return -EBUSY;
        }

. But what is the correct approach?