Re: [PATCH net 2/6] can: bcm: prevent thrtimer UAF in rx path by checking RX_NO_AUTOTIMER

[Jakub Kicinski <kuba@kernel.org>]

On Thu,  7 May 2026 10:22:24 +0200 Marc Kleine-Budde wrote:
> Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
> synchronize_rcu()") removed the synchronize_rcu() call from
> bcm_delete_rx_op() and introduced the RX_NO_AUTOTIMER flag to prevent
> timers from being rearmed during deletion.  However, it only applied
> this check to op->timer via bcm_rx_starttimer().

All AIs point out this is insufficient:

    reader (bcm_rx_handler, RCU) | writer (bcm_delete_rx_op)
    -----------------------------+-------------------------------
    test op->flags (no AUTOTIMER)|
                                 | op->flags |= RX_NO_AUTOTIMER
                                 | bcm_remove_op()
                                 |   hrtimer_cancel(&op->thrtimer)
                                 |     /* not armed: no-op */
                                 | call_rcu(bcm_free_op_rcu)
    hrtimer_start(&op->thrtimer) |
    return from RCU section      |
                                 | grace period elapses
                                 | bcm_free_op_rcu() -> kfree(op)
    thrtimer fires               |
      bcm_rx_thr_handler(op)     | <-- UAF