Re: [PATCH v2] can: j1939: make j1939_sk_bind() fail if device is no longer registered

[Oleksij Rempel <o.rempel@pengutronix.de>]

On Tue, Nov 25, 2025 at 10:43:12PM +0900, Tetsuo Handa wrote:
> There is a theoretical race window in j1939_sk_netdev_event_unregister()
> where two j1939_sk_bind() calls jump in between read_unlock_bh() and
> lock_sock().
> 
> The assumption jsk->priv == priv can fail if the first j1939_sk_bind()
> call once made jsk->priv == NULL due to failed j1939_local_ecu_get() call
> and the second j1939_sk_bind() call again made jsk->priv != NULL due to
> successful j1939_local_ecu_get() call.
> 
> Since the socket lock is held by both j1939_sk_netdev_event_unregister()
> and j1939_sk_bind(), checking ndev->reg_state with the socket lock held can
> reliably make the second j1939_sk_bind() call fail (and close this race
> window).
> 
> Fixes: 7fcbe5b2c6a4 ("can: j1939: implement NETDEV_UNREGISTER notification handler")
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

I guess, this one is needed too:
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |