Re: [PATCH v4 4/7] can: bcm: fix CAN frame rx/tx statistics

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing RCU memory barriers when inserting new bcm_op entries into rx_ops and tx_ops, and incorrect list traversal macro for tx_ops in a lockless reader.
--

--- Patch [4]: [PATCH v4 4/7] can: bcm: fix CAN frame rx/tx statistics ---
commit 55dc712979cc536660202ae53cf4b6529bfdf948
Author: Oliver Hartkopp <socketcan@hartkopp.net>

can: bcm: fix CAN frame rx/tx statistics

This commit fixes a data race detected by KCSAN in bcm_rx_handler by
using atomic types for frame statistics, and adds a lock-protected
helper for updates to avoid races during resets.

> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c
> @@ -229,10 +229,13 @@ static int bcm_proc_show(struct seq_file *m, void *v)
>  
>  	list_for_each_entry_rcu(op, &bo->rx_ops, list) {

[Severity: High]
This isn't a bug introduced by this patch, but there appears to be a
missing RCU barrier when traversing and modifying the bcm_op lists.

Can the lockless reader in bcm_proc_show() observe uninitialized memory
here?

While the reader correctly uses list_for_each_entry_rcu() for rx_ops, the
writer in bcm_rx_setup() adds new entries using the non-RCU list_add():

net/can/bcm.c:bcm_rx_setup() {
    ...
    list_add(&op->list, &bo->rx_ops);
    ...
}

Without list_add_rcu(), the CPU could reorder the initialization of the
bcm_op struct to occur after the node becomes visible in the list.

Similarly, does the tx_ops list traversal lack both writer and reader
RCU protection?

net/can/bcm.c:bcm_tx_setup() {
    ...
    list_add(&op->list, &bo->tx_ops);
    ...
}

And later in bcm_proc_show():

net/can/bcm.c:bcm_proc_show() {
    ...
    list_for_each_entry(op, &bo->tx_ops, list) {
    ...
}

Should these lists be updated to use list_add_rcu() and
list_for_each_entry_rcu() to ensure safe concurrent iteration via procfs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707-bcm_fixes-v4-0-aa87b8b9d33f@hartkopp.net?part=4