By stress testing socket session queue I detected a racecondition in this function. For example two concurrent socket fighting for same session place in the active list would inject two concurrent session to it. Signed-off-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx> --- net/can/j1939/transport.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c index 5152b5518613..e2343978f695 100644 --- a/net/can/j1939/transport.c +++ b/net/can/j1939/transport.c @@ -1141,17 +1141,18 @@ static int j1939_session_insert(struct j1939_session *session) struct j1939_session *pending; int ret = 0; - pending = j1939_session_get_by_skcb(priv, &session->skcb, false); + j1939_session_list_lock(priv); + pending = j1939_session_get_by_skcb_locked(priv, &priv->tp_sessionq, + &session->skcb, false); if (pending) { j1939_session_put(pending); ret = -EAGAIN; } else { - j1939_session_list_lock(priv); WARN_ON_ONCE(session->state != J1939_SESSION_NEW); j1939_session_list_add(session); session->state = J1939_SESSION_ACTIVE; - j1939_session_list_unlock(priv); } + j1939_session_list_unlock(priv); return ret; } -- 2.20.1