Description
In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after commit 93a27b5891b8 ("can: j1939: add missing calls in NETDEV_UNREGISTER notification handler") was added. A debug printk() patch found that j1939_session_activate() can succeed even after j1939_cancel_active_session() from j1939_netdev_notify(NETDEV_UNREGISTER) has completed. Since j1939_cancel_active_session() is processed with the session list lock held, checking ndev->reg_state in j1939_session_activate() with the session list lock held can reliably close the race window.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9d71dd0c70099914fcd063135da3c580865e924c to < ebb0dfd718dd31c8d3600612ca4b7207ec3d923aaffected9d71dd0c70099914fcd063135da3c580865e924c to < c3a4316e3c746af415c0fd6c6d489ad13f53714daffected9d71dd0c70099914fcd063135da3c580865e924c to < 46ca9dc978923c5e1247a9e9519240ba7ace413caffected9d71dd0c70099914fcd063135da3c580865e924c to < 78d87b72cebe2a993fd5b017e9f14fb6278f2eaeaffected9d71dd0c70099914fcd063135da3c580865e924c to < ba6f0d1832eeb5eb3a6dc5cb30e0f720b3cb3536affected9d71dd0c70099914fcd063135da3c580865e924c to < 79dd3f1d9dd310c2af89b09c71f34d93973b200faffected9d71dd0c70099914fcd063135da3c580865e924c to < 5d5602236f5db19e8b337a2cd87a90ace5ea776daffected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.10.248 to ≤ 5.10.*unaffected5.15.198 to ≤ 5.15.*unaffected6.1.161 to ≤ 6.1.*unaffected6.6.121 to ≤ 6.6.*unaffected6.12.66 to ≤ 6.12.*unaffected6.18.6 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ebb0dfd718dd31c8d3600612ca4b7207ec3d923a ↗
- https://git.kernel.org/stable/c/c3a4316e3c746af415c0fd6c6d489ad13f53714d ↗
- https://git.kernel.org/stable/c/46ca9dc978923c5e1247a9e9519240ba7ace413c ↗
- https://git.kernel.org/stable/c/78d87b72cebe2a993fd5b017e9f14fb6278f2eae ↗
- https://git.kernel.org/stable/c/ba6f0d1832eeb5eb3a6dc5cb30e0f720b3cb3536 ↗
- https://git.kernel.org/stable/c/79dd3f1d9dd310c2af89b09c71f34d93973b200f ↗
- https://git.kernel.org/stable/c/5d5602236f5db19e8b337a2cd87a90ace5ea776d ↗