can: j1939: add missing calls in NETDEV_UNREGISTER notification handler

JIRA: https://issues.redhat.com/browse/RHEL-124109
CVE: CVE-2025-39925

commit 93a27b5
Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date:   Sat Sep 27 21:11:16 2025 +0900

    can: j1939: add missing calls in NETDEV_UNREGISTER notification handler

    Currently NETDEV_UNREGISTER event handler is not calling
    j1939_cancel_active_session() and j1939_sk_queue_drop_all().
    This will result in these calls being skipped when j1939_sk_release() is
    called. And I guess that the reason syzbot is still reporting

      unregister_netdevice: waiting for vcan0 to become free. Usage count = 2

    is caused by lack of these calls.

    Calling j1939_cancel_active_session(priv, sk) from j1939_sk_release() can
    be covered by calling j1939_cancel_active_session(priv, NULL) from
    j1939_netdev_notify().

    Calling j1939_sk_queue_drop_all() from j1939_sk_release() can be covered
    by calling j1939_sk_netdev_event_netdown() from j1939_netdev_notify().

    Therefore, we can reuse j1939_cancel_active_session(priv, NULL) and
    j1939_sk_netdev_event_netdown(priv) for NETDEV_UNREGISTER event handler.

    Fixes: 7fcbe5b ("can: j1939: implement NETDEV_UNREGISTER notification handler")
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
    Link: https://patch.msgid.link/3ad3c7f8-5a74-4b07-a193-cb0725823558@I-love.SAKURA.ne.jp
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

Author: CKI Backport Bot

net/can/j1939/main.c

@@ -378,6 +378,8 @@ static int j1939_netdev_notify(struct notifier_block *nb,
 		j1939_ecu_unmap_all(priv);
 		break;
 	case NETDEV_UNREGISTER:
+		j1939_cancel_active_session(priv, NULL);
+		j1939_sk_netdev_event_netdown(priv);
 		j1939_sk_netdev_event_unregister(priv);
 		break;
 	}