From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF491471412; Tue, 21 Jul 2026 19:58:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784663896; cv=none; b=Yrq+OlcS6rclEi1ys8daKv+H6NJy0iZU0jBTnYQwqZUAKrNNVK5+i3KwnUzlhOq2SxWBfHiHKbOvZpamDjAJvxeXTaGvMAZWR5KKvYh/HaYtQ3oOtytKUberZswKF2MkBMWOLxggi340pbqQj2J+VFdp4ug8ZN5T9BohBIKm2ao= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784663896; c=relaxed/simple; bh=yZxHXZT3umkNWePShVQ2b4e1PRNcDLkNYRG3bmgcnOQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GZRQEXGDOyuxaqJai/BELTFFBLThDnPsJHR0+PhmXvBK4ZgLmJJe9w5cXrvOyXlbla83656oPRH9gWCRIhy0Lo4HWixvjgNpvbcrj8HPo2fIFvF1vJtfwPAL7Dxtms3BbM153ZFdhk1MYrkhx/j3ImQLkWJbgBWBEljlEqykTZg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=IzXZ9Mpg; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="IzXZ9Mpg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8CAF01F00A3A; Tue, 21 Jul 2026 19:58:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784663893; bh=TENz46uxcVaFn9x6f3MpRPmHMHn+UIKLflba1UNe/D0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IzXZ9Mpg6RwlyeoALszBOXNgGbshHIc3QH0BmLV5TJcUV+gpM8hV4CgdBLLku8k4S 3sJ6O9QESKhBZVMnwr4/BFZM84TwkliXD5xbDB7ihHmkJ6xi4jr2rusqM91jsWkwQJ mTL12e91G1Z+yCo7ZdKpaCpgtRPwRi/dO8RZ5i1I= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-reviews@lists.linux.dev, Oliver Hartkopp , stable@kernel.org, Marc Kleine-Budde Subject: [PATCH 6.12 0995/1276] can: bcm: add missing rcu list annotations and operations Date: Tue, 21 Jul 2026 17:23:58 +0200 Message-ID: <20260721152508.277466718@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152446.065700225@linuxfoundation.org> References: <20260721152446.065700225@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Hartkopp commit 7b2c3eabc4dafc062a25e10711154f2107526a78 upstream. sashiko-bot remarked the missing use of list_add_rcu() in bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure when bcm_proc_show() traverses the bcm_op's under rcu_read_lock(). To cover all initial settings of the bcm_op's the list_add_rcu() calls are moved to the end of the setup code. While at it, also fix the mirroring removal side: bcm_release() called bcm_remove_op() - which frees the op via call_rcu() - on ops that were still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first. Unlink each op with list_del_rcu() before handing it to bcm_remove_op(), matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op(). Reported-by: sashiko-reviews@lists.linux.dev Closes: https://lore.kernel.org/linux-can/20260610094654.A1FFE1F00893@smtp.kernel.org/ Fixes: dac5e6249159 ("can: bcm: add missing rcu read protection for procfs content") Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260714-bcm_fixes-v15-5-562f7e3e42da@hartkopp.net Cc: stable@kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- net/can/bcm.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -260,7 +260,7 @@ static int bcm_proc_show(struct seq_file (reduction == 100) ? "near " : "", reduction); } - list_for_each_entry(op, &bo->tx_ops, list) { + list_for_each_entry_rcu(op, &bo->tx_ops, list) { seq_printf(m, "tx_op: %03X %s ", op->can_id, bcm_proc_getifname(net, ifname, op->ifindex)); @@ -945,6 +945,7 @@ static int bcm_tx_setup(struct bcm_msg_h struct bcm_sock *bo = bcm_sk(sk); struct bcm_op *op; struct canfd_frame *cf; + bool add_op_to_list = false; unsigned int i; int err; @@ -1087,8 +1088,7 @@ static int bcm_tx_setup(struct bcm_msg_h hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); - /* add this bcm_op to the list of the tx_ops */ - list_add(&op->list, &bo->tx_ops); + add_op_to_list = true; } /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */ @@ -1110,6 +1110,10 @@ static int bcm_tx_setup(struct bcm_msg_h op->flags |= TX_ANNOUNCE; } + /* add this bcm_op to the list of the tx_ops? */ + if (add_op_to_list) + list_add_rcu(&op->list, &bo->tx_ops); + if (op->flags & TX_ANNOUNCE) bcm_can_tx(op); @@ -1253,9 +1257,6 @@ static int bcm_rx_setup(struct bcm_msg_h HRTIMER_MODE_REL_SOFT); op->thrtimer.function = bcm_rx_thr_handler; - /* add this bcm_op to the list of the rx_ops */ - list_add(&op->list, &bo->rx_ops); - /* call can_rx_register() */ do_rx_register = 1; @@ -1334,10 +1335,12 @@ static int bcm_rx_setup(struct bcm_msg_h bcm_rx_handler, op, "bcm", sk); if (err) { /* this bcm rx op is broken -> remove it */ - list_del_rcu(&op->list); bcm_remove_op(op); return err; } + + /* add this bcm_op to the list of the rx_ops */ + list_add_rcu(&op->list, &bo->rx_ops); } return msg_head->nframes * op->cfsiz + MHSIZ; @@ -1667,8 +1670,10 @@ static int bcm_release(struct socket *so remove_proc_entry(bo->procname, net->can.bcmproc_dir); #endif /* CONFIG_PROC_FS */ - list_for_each_entry_safe(op, next, &bo->tx_ops, list) + list_for_each_entry_safe(op, next, &bo->tx_ops, list) { + list_del_rcu(&op->list); bcm_remove_op(op); + } list_for_each_entry_safe(op, next, &bo->rx_ops, list) { /* @@ -1699,8 +1704,10 @@ static int bcm_release(struct socket *so synchronize_rcu(); - list_for_each_entry_safe(op, next, &bo->rx_ops, list) + list_for_each_entry_safe(op, next, &bo->rx_ops, list) { + list_del_rcu(&op->list); bcm_remove_op(op); + } /* remove device reference */ if (bo->bound) {