Re: [PATCH v2] can: bcm: prevent thrtimer UAF in rx path by checking RX_NO_AUTOTIMER

[Lee Jones <lee@kernel.org>]

On Wed, 20 May 2026, Oliver Hartkopp wrote:
> > > Ok, thanks for the detailed explanation!
> > > 
> > > As your updated patch fixes the original patch
> > > 
> > > f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
> > > synchronize_rcu()")
> > > 
> > > we should also revert this op->flags setting that has been introduced with
> > > that patch in addition to the rcu stuff, right?
> > > 
> > > @@ -755,10 +763,13 @@ static int bcm_delete_rx_op(struct list_head *ops,
> > > struct bcm_msg_head *mh,
> > > 
> > >          list_for_each_entry_safe(op, n, ops, list) {
> > >                  if ((op->can_id == mh->can_id) && (op->ifindex == ifindex)
> > > &&
> > >                      (op->flags & CAN_FD_FRAME) == (mh->flags &
> > > CAN_FD_FRAME)) {
> > > 
> > > +                       /* disable automatic timer on frame reception */
> > > +                       op->flags |= RX_NO_AUTOTIMER;
> > > +
> > 
> > You mean from v1?  I thought that was NACKed and not applied?
> 
> No. These two lines were introduced in the original patch you aim to fix. So
> when fixing the original "use call_rcu() instead of costly
> synchronize_rcu()" patch that introduced the rcu stuff, this now obsolete
> op->flags |= RX_NO_AUTOTIMER should be removed too.

Is that not orthogonal to the fix?

If it is, would you be kind enough to submit a fix (and get your own
creds up ;-D).  This is usually something that I'd gleefully pick up,
but I'm absolutely inundated with vulnerability reports right now.

-- 
Lee Jones