Re: [PATCH v2 (repost)] can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking

[Oleksij Rempel <o.rempel@pengutronix.de>]

On Fri, May 29, 2026 at 10:31:22AM +0900, Tetsuo Handa wrote:
> syzbot is still reporting
> 
>   unregister_netdevice: waiting for vcan0 to become free. Usage count = 2
> 
> problem. A debug printk() patch in linux-next-20260508 identified that
> there is dev_hold()/dev_put() imbalance in j1939_priv management.
> 
>   Call trace for vcan0[26] +4 at
>      __dev_hold include/linux/netdevice.h:4470 [inline]
>      netdev_hold include/linux/netdevice.h:4513 [inline]
>      dev_hold include/linux/netdevice.h:4536 [inline]
>      j1939_priv_create net/can/j1939/main.c:140 [inline]
>      j1939_netdev_start+0x36b/0xc10 net/can/j1939/main.c:268
>      j1939_sk_bind+0x853/0xb30 net/can/j1939/socket.c:506
>      __sys_bind_socket net/socket.c:1948 [inline]
>      __sys_bind+0x2e9/0x410 net/socket.c:1979
> 
>   Call trace for vcan0[28] -3 at
>      __dev_put include/linux/netdevice.h:4456 [inline]
>      netdev_put include/linux/netdevice.h:4523 [inline]
>      dev_put include/linux/netdevice.h:4548 [inline]
>      __j1939_priv_release net/can/j1939/main.c:166 [inline]
>      kref_put include/linux/kref.h:65 [inline]
>      j1939_priv_put+0x128/0x270 net/can/j1939/main.c:172
>      j1939_sk_sock_destruct+0x52/0x90 net/can/j1939/socket.c:388
>      __sk_destruct+0x8d/0x9d0 net/core/sock.c:2352
>      rcu_do_batch kernel/rcu/tree.c:2617 [inline]
>      rcu_core kernel/rcu/tree.c:2869 [inline]
>      rcu_cpu_kthread+0x99e/0x1470 kernel/rcu/tree.c:2957
>      smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
>      kthread+0x388/0x470 kernel/kthread.c:436
>      ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>      ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> 
> This refcount leak in j1939_priv might be caused by a refcount leak in
> j1939_{session,ecu} because j1939_{session,ecu} holds a ref on j1939_priv.
> For further investigation using upstream kernels, enable netdevice_tracker
> in j1939_{priv,session,ecu} management.
> 
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>

Thank you!

Best Regards,
Oleksij
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |