Re: [syzbot] [can?] possible deadlock in j1939_sk_errqueue (2)

[syzbot]

> On Mon, 10 Jul 2023 10:53:57 -0700
>> HEAD commit:    e40939bbfc68 Merge branch 'for-next/core' into for-kernelci
>> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=178f78d4a80000
>
> Put session without the session list lock held.
>
> #syz test https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git  e40939bbfc68

Your commands are accepted, but please keep syzkaller-bugs@xxxxxxxxxxxxxxxx mailing list in CC next time. It serves as a history of what happened with each bug report. Thank you.

>
> --- x/net/can/j1939/transport.c
> +++ y/net/can/j1939/transport.c
> @@ -1083,7 +1083,6 @@ static bool j1939_session_deactivate_loc
>  
>  		list_del_init(&session->active_session_list_entry);
>  		session->state = J1939_SESSION_DONE;
> -		j1939_session_put(session);
>  	}
>  
>  	return active;
> @@ -1098,6 +1097,9 @@ static bool j1939_session_deactivate(str
>  	active = j1939_session_deactivate_locked(session);
>  	j1939_session_list_unlock(priv);
>  
> +	if (active)
> +		j1939_session_put(session);
> +
>  	return active;
>  }
>  
> @@ -2178,6 +2180,7 @@ void j1939_simple_recv(struct j1939_priv
>  int j1939_cancel_active_session(struct j1939_priv *priv, struct sock *sk)
>  {
>  	struct j1939_session *session, *saved;
> +	LIST_HEAD(active);
>  
>  	netdev_dbg(priv->ndev, "%s, sk: %p\n", __func__, sk);
>  	j1939_session_list_lock(priv);
> @@ -2191,10 +2194,16 @@ int j1939_cancel_active_session(struct j
>  				j1939_session_put(session);
>  
>  			session->err = ESHUTDOWN;
> -			j1939_session_deactivate_locked(session);
> +			if (j1939_session_deactivate_locked(session))
> +				list_move(&session->active_session_list_entry, &active);
>  		}
>  	}
>  	j1939_session_list_unlock(priv);
> +
> +	list_for_each_entry_safe(session, saved, &active, active_session_list_entry) {
> +		list_del_init(&session->active_session_list_entry);
> +		j1939_session_put(session);
> +	}
>  	return NOTIFY_DONE;
>  }
>  
> --