kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Tetsuo Handa 1473bb50cb can: j1939: make j1939_sk_bind() fail if device is no longer registered 
[ Upstream commit 46cea215dc ]

There is a theoretical race window in j1939_sk_netdev_event_unregister()
where two j1939_sk_bind() calls jump in between read_unlock_bh() and
lock_sock().

The assumption jsk->priv == priv can fail if the first j1939_sk_bind()
call once made jsk->priv == NULL due to failed j1939_local_ecu_get() call
and the second j1939_sk_bind() call again made jsk->priv != NULL due to
successful j1939_local_ecu_get() call.

Since the socket lock is held by both j1939_sk_netdev_event_unregister()
and j1939_sk_bind(), checking ndev->reg_state with the socket lock held can
reliably make the second j1939_sk_bind() call fail (and close this race
window).

Fixes: 7fcbe5b2c6 ("can: j1939: implement NETDEV_UNREGISTER notification handler")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/5732921e-247e-4957-a364-da74bd7031d7@I-love.SAKURA.ne.jp
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-09-02 14:27:26 +02:00
..
6lowpan 6lowpan: fix NHC entry use-after-free on error path 2026-07-24 15:51:20 +02:00
9p net/9p: fix infinite loop in p9_client_rpc on fatal signal 2026-07-24 15:51:50 +02:00
802 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr 2026-06-19 13:33:34 +02:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm net: atm: reject out-of-range traffic classes in QoS validation 2026-07-24 15:51:46 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: clean untagged VLAN on netdev registration failure 2026-07-24 15:51:53 +02:00
bluetooth Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept 2026-08-27 14:28:18 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge netfilter: bridge: release template ct on non-IP path 2026-08-19 17:14:17 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: j1939: make j1939_sk_bind() fail if device is no longer registered 2026-09-02 14:27:26 +02:00
ceph libceph: fix OOB read in decode_watchers() via missing bounds check 2026-08-27 14:28:20 +02:00
core bpf: Remove tst_run from lwt_seg6local_prog_ops. 2026-09-02 14:27:25 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: tag_ksz: do not rely on skb_mac_header() in TX paths 2026-07-24 15:51:27 +02:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: eeprom: add more safeties to EEPROM Netlink fallback 2026-06-19 13:33:24 +02:00
hsr net: hsr: fix memory leak on slave unregistration by removing synced VLANs 2026-08-19 17:13:58 +02:00
ieee802154 ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 2026-07-24 15:51:53 +02:00
ife net: ife: require ETH_HLEN to be pullable in ife_decode() 2026-07-24 15:51:46 +02:00
ipv4 inet: frags: strip GSO state from fragments before reassembly 2026-08-28 08:20:31 +02:00
ipv6 ipv6: fix use-after-free in ip6_finish_output2() 2026-08-27 14:28:21 +02:00
iucv net/iucv: fix use-after-free of a severed iucv_path 2026-08-19 17:14:04 +02:00
kcm kcm: use WRITE_ONCE() when changing lower socket callbacks 2026-07-24 15:51:36 +02:00
key net: af_key: initialize alg_key_len for IPComp states 2026-07-24 15:51:21 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix SAP refcount leak when creating incoming sockets 2026-07-24 15:51:55 +02:00
mac80211 wifi: mac80211: validate individual TWT params before driver setup 2026-08-19 17:14:07 +02:00
mac802154 mac802154: llsec: reject frames shorter than the authentication tag 2026-08-19 17:14:04 +02:00
mctp net: mctp: fix don't require received header reserved bits to be zero 2026-06-19 13:33:41 +02:00
mpls net: mpls: initialize rtm_tos in mpls_getroute() 2026-08-19 17:14:05 +02:00
mptcp mptcp: pm: fix data race in add_addr timer callback 2026-08-27 14:28:22 +02:00
ncsi net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 2026-08-19 17:14:14 +02:00
netfilter ipvs: reload ip header after head reallocation 2026-09-02 14:27:25 +02:00
netlabel netlabel: validate unlabeled address and mask attribute lengths 2026-06-19 13:33:35 +02:00
netlink rtnetlink: add RTNL_FLAG_DUMP_UNLOCKED flag 2026-07-24 15:51:42 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc nfc: nci: free destination parameters when closing a connection 2026-08-27 14:28:20 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch openvswitch: move key and ovs_cb update out of handle_fragments 2026-08-23 14:17:30 +02:00
packet packet: synchronize pressure clearing with ring reconfiguration 2026-08-27 14:28:20 +02:00
phonet phonet: pep: fix use-after-free in pep_get_sb() 2026-08-19 17:14:03 +02:00
psample net: psample: fix info leak in PSAMPLE_ATTR_DATA 2026-07-24 15:51:39 +02:00
qrtr net: qrtr: ns: Raise lookup limit to 128 2026-08-19 17:14:14 +02:00
rds rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() 2026-08-19 17:14:06 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: serialize kernel accept preallocation with socket teardown 2026-08-23 14:17:18 +02:00
sched net/sched: reject overly deep qdisc hierarchies 2026-08-27 14:28:19 +02:00
sctp sctp: avoid auth_enable sysctl UAF during netns teardown 2026-08-23 14:17:27 +02:00
smc net: smc: fix splice entry lifetime imbalance in smc_rx_splice 2026-08-23 14:17:30 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc xprtrdma: Fix bcall rep leak and unbounded peek 2026-07-24 15:51:38 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: restrict socket queue dumps in enqueue tracepoints 2026-08-23 14:17:18 +02:00
tls tls: don't abort the connection on signal-interrupted sends 2026-08-19 17:14:14 +02:00
unix af_unix: Reject SIOCATMARK on non-stream sockets 2026-07-04 13:39:37 +02:00
vmw_vsock vsock/virtio: avoid refilling the RX queue after teardown 2026-08-19 17:14:17 +02:00
wireless wifi: cfg80211: bound element ID read when checking non-inheritance 2026-08-19 17:13:53 +02:00
x25 net/x25: fix use-after-free of the socket by its timers 2026-08-23 14:17:31 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm xfrm: fix sk_dst_cache double-free in xfrm_user_policy() 2026-08-27 14:28:22 +02:00
compat.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Drop the lock in skb_may_tx_timestamp() 2026-07-24 15:51:21 +02:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00