Re: [PATCH] can: j1939: Use hrtimer_cancel in j1939_cancel_active_session

[Oleksij Rempel <o.rempel@pengutronix.de>]

Hi Dudu,

On Mon, Apr 13, 2026 at 04:45:48PM +0800, Dudu Lu wrote:
> j1939_cancel_active_session() uses hrtimer_try_to_cancel() for both
> txtimer and rxtimer. When hrtimer_try_to_cancel() returns -1, it means
> the timer callback is currently executing. In this case, the function
> neither cancels the timer nor drops the session reference via
> j1939_session_put(). The session is then deactivated while the timer
> callback may still be running, leading to a potential use-after-free if
> the callback accesses the session after it has been cleaned up.
> 
> Replace hrtimer_try_to_cancel() with hrtimer_cancel() which will wait
> for an in-progress callback to complete before returning, ensuring the
> timer is fully stopped before the session is deactivated.
> 
> Note: This changes the function to potentially sleep (hrtimer_cancel
> waits for the callback). The function is called with
> active_session_list_lock held (a spinlock), so an alternative approach
> would be to handle the -1 return from hrtimer_try_to_cancel() without
> blocking. However, if the lock can be converted or the cancel moved
> outside the lock, hrtimer_cancel() is the cleaner fix.

Is it real or academical issue? Are there some bug report or exploit?

Best regards,
Oleksij
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |