Re: [PATCH] can: j1939: make j1939_session_activate() fail if device is no longer registered

[Oleksij Rempel <o.rempel@pengutronix.de>]

On Tue, Nov 25, 2025 at 10:39:59PM +0900, Tetsuo Handa wrote:
> syzbot is still reporting
> 
>   unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
> 
> even after commit 93a27b5891b8 ("can: j1939: add missing calls in
> NETDEV_UNREGISTER notification handler") was added. A debug printk() patch
> found that j1939_session_activate() can succeed even after
> j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER)
> has completed.
> 
> Since j1939_cancel_active_session() is processed with the session list lock
> held, checking ndev->reg_state in j1939_session_activate() with the session
> list lock held can reliably close the race window.
> 
> Reported-by: syzbot <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
> Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>

Thank you!
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |