Re: [PATCH v7 10/10] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Multiplexed or throttled CAN frames share a single global `rx_stamp` and `rx_ifindex`, which are overwritten by rejected or unrelated multiplex frames, causing metadata corruption when sending throttled frames to userspace.
--

--- Patch [10]: [PATCH v7 10/10] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() ---
commit 981b0672b1caa15044dae2fc2e2b6c5ccb8394f9
Author: Oliver Hartkopp <socketcan@hartkopp.net>

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

This commit moves the updates to op->rx_stamp and op->rx_ifindex inside
the bcm_rx_update_lock section to prevent data races. It also notes that
metadata is bundled correctly when running concurrently on different CPUs
for wildcard interface subscriptions.

Link: https://lore.kernel.org/linux-can/20260707145135.5BC831F00A3A@smtp.kernel.org/

> diff --git a/net/can/bcm.c b/net/can/bcm.c
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c
[ ... ]
> @@ -805,6 +800,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
>  
>  	spin_lock_bh(&op->bcm_rx_update_lock);
>  
> +	/* save rx timestamp and originator for recvfrom() under lock.
> +	 * For an op subscribed on all interfaces (ifindex == 0)
> +	 * bcm_rx_handler() can run concurrently on different CPUs so
> +	 * the CAN content and the meta data must be bundled correctly.
> +	 */
> +	op->rx_stamp = skb->tstamp;
> +	op->rx_ifindex = skb->dev->ifindex;
> +

[Severity: High]
This is a pre-existing issue, but by updating op->rx_stamp and
op->rx_ifindex unconditionally here before checking the multiplex mask,
are we risking metadata corruption for throttled frames?

If a valid multiplexed frame is received and throttled, its payload is
buffered. If another frame with the same CAN ID but a non-matching
multiplex ID (or on a different interface) arrives while the throttle
timer is running, we reach this code and overwrite the global op->rx_stamp
and op->rx_ifindex.

When the timer later expires, bcm_rx_thr_flush() flushes all pending
throttled MUX frames using the shared overwritten metadata:

net/can/bcm.c:bcm_rx_thr_flush() {
    ...
    for (i = 1; i < op->nframes; i++)
        updated += bcm_rx_do_flush(op, i);
    ...
}

Which propagates to bcm_rx_changed():

net/can/bcm.c:bcm_rx_changed() {
    ...
    bcm_send_to_user(op, &head, data, 1);
    ...
}

Could this cause applications to respond on the wrong CAN bus interface if
recvfrom() returns the incorrectly overwritten ifindex?

>  	if (op->flags & RX_FILTER_ID) {
>  		/* the easiest case */
>  		bcm_rx_update_and_send(op, op->last_frames, rxframe,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bcm_fixes-v7-0-c78896b342e4@hartkopp.net?part=10