Re: [PATCH v8 10/10] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the patch fails to fully resolve the issue it claims to fix: Metadata mismatch for delayed/throttled CAN frames. `op->rx_stamp` and `op->rx_ifindex` are overwritten by subsequent frames, causing delayed frames to be delivered with incorrect timestamps and originator ifindexes.
--

--- Patch [10]: [PATCH v8 10/10] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() ---
commit 1903094034673eeaf05aa58b49f4d0ff45d06795
Author: Oliver Hartkopp <socketcan@hartkopp.net>

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

This commit addresses data races and torn stores on rx_stamp and rx_ifindex
by moving their assignment inside the bcm_rx_update_lock section in
bcm_rx_handler(). It ensures CAN content and metadata are bundled correctly.

Link: https://lore.kernel.org/linux-can/20260707145135.5BC831F00A3A@smtp.kernel.org/

> diff --git a/net/can/bcm.c b/net/can/bcm.c
> index 66dd8789843b5..1986d33a7d279 100644
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c

[ ... ]

> @@ -805,6 +800,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
>  
>  	spin_lock_bh(&op->bcm_rx_update_lock);
>  
> +	/* save rx timestamp and originator for recvfrom() under lock.
> +	 * For an op subscribed on all interfaces (ifindex == 0)
> +	 * bcm_rx_handler() can run concurrently on different CPUs so
> +	 * the CAN content and the meta data must be bundled correctly.
> +	 */
> +	op->rx_stamp = skb->tstamp;
> +	op->rx_ifindex = skb->dev->ifindex;

[Severity: High]
This isn't a bug introduced by this patch, but does this fully resolve the
metadata mismatch for delayed or throttled CAN frames?

Since op->rx_stamp and op->rx_ifindex are unconditionally updated here, will
they overwrite the metadata corresponding to pending throttled frames?

If an application configures a BCM socket with a throttle timer (kt_ival2 > 0)
and a frame is marked for delayed delivery, a subsequent frame arriving before
the timer expires will overwrite this global metadata.

When the timer expires and the delayed frame is eventually flushed to user
space via bcm_send_to_user(), it will be sent with the clobbered
op->rx_ifindex rather than the interface it originally arrived on. Could this
lead to the user application receiving an incorrect source interface and
potentially responding on the wrong CAN bus?

> +
>  	if (op->flags & RX_FILTER_ID) {
>  		/* the easiest case */
>  		bcm_rx_update_and_send(op, op->last_frames, rxframe,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bcm_fixes-v8-0-8c2f5f3bc212@hartkopp.net?part=10