Re: [PATCH] can: j1939: j1939_sk_bind(): fix j1939_ecu leak when re-bind failed

On Fri, Aug 21, 2026 at 01:28:13AM +0900, Tetsuo Handa wrote:
> syzbot is reporting "struct j1939_ecu" refcount leak, which occurs when
> netdev_hold() is called during ECU creation but the corresponding
> netdev_put() is never executed because the parent "struct j1939_ecu"
> object is leaked.
> 
....
> 
> The root cause lies in the error handling of j1939_sk_bind() during a
> re-bind operation (binding an already bound socket to the same interface).
> Currently, the function prematurely drops the old ECU references by calling
> j1939_local_ecu_put() before verifying whether the new configuration can be
> successfully acquired via j1939_local_ecu_get().
> 
> If j1939_local_ecu_get() subsequently fails, the function unconditionally
> calls j1939_netdev_stop() and clears jsk->priv. This leaves the socket in a
> half-broken state where the old ECU's refcount has already been decremented
> incompletely, but the socket destruct pathway (j1939_sk_sock_destruct) can
> no longer perform proper cleanup because jsk->priv is NULL. As a result,
> the old "struct j1939_ecu" remains orphaned on the priv->ecus list,
> permanently leaking both the ECU object and the net_device reference held
> inside it.
> 
> Fix this by deferring the removal and release of the old ECU references
> until after j1939_local_ecu_get() has successfully acquired the new
> resources. As a side effect of this change, the socket's state no longer
> changes when the re-bind operation failed.
> 
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=e2af46126e0644cbebdd
> Analyzed-by: AI Mode in Google Search (no mail address)
> Fixes: f214744c8a27 ("can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed")
> Signed-off-by: Tetsuo Handa <[email protected]>

Acked-by: Oleksij Rempel <[email protected]>

Thank you!
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |