Re: [PATCH v9 01/10] can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Module exit triggers a kmem_cache_destroy warning because the protocol slab cache is destroyed before the deferred workqueue frees the remaining sockets.
--

--- Patch [1]: [PATCH v9 01/10] can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF ---
commit d847f243125a944d43b2a6970166b528eea27549
Author: Lee Jones <lee@kernel.org>

can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

This commit resolves a use-after-free condition in the broadcast manager 
rx operation teardown. It moves the timer cancellation and memory deallocation 
to a dedicated unbound workqueue, and ensures the socket reference is held 
until the deferred work executes safely in process context.

> diff --git a/net/can/bcm.c b/net/can/bcm.c
> index a4bef2c48a559..bdf53241bd7b3 100644
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c
[ ... ]
> @@ -1869,6 +1898,8 @@ static void __exit bcm_module_exit(void)
>  	can_proto_unregister(&bcm_can_proto);
>  	unregister_netdevice_notifier(&canbcm_notifier);
>  	unregister_pernet_subsys(&canbcm_pernet_ops);
> +	rcu_barrier();
> +	destroy_workqueue(bcm_wq);
>  }

[Severity: High]
Will this sequence trigger a kmem_cache_destroy warning on module unload?

Since bcm_module_exit() calls can_proto_unregister() before
destroy_workqueue(), the protocol slab cache is destroyed while deferred
work items that release sockets back to the cache might still be pending in
bcm_wq.

Should destroy_workqueue() be called before can_proto_unregister() to
ensure all pending socket frees are completed prior to the protocol slab
cache destruction?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-bcm_fixes-v9-0-6eebb78ccfb2@hartkopp.net?part=1