Re: [PATCH v11 10/11] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unconditional overwrite of `op->rx_stamp` corrupts timestamp metadata for throttled or multiplexed CAN frames.
--

--- Patch [10]: [PATCH v11 10/11] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() ---
commit 962a73c290cc743e31470d3c9ed820b166d58a79
Author: Oliver Hartkopp <socketcan@hartkopp.net>

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

This commit moves the update of rx_stamp and rx_ifindex under the
bcm_rx_update_lock to prevent concurrent writers from racing each
other, avoiding torn stores on 32-bit platforms. It also ensures
metadata is bundled correctly with the frame content delivered to
userspace.

Link: https://lore.kernel.org/linux-can/20260707145135.5BC831F00A3A@smtp.kernel.org/

> diff --git a/net/can/bcm.c b/net/can/bcm.c
> index fbf1cbb7c99fe..10a883b50fc63 100644
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c

[ ... ]

> @@ -815,6 +810,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
>  			traffic_flags |= RX_OWN;
>  	}
>  
> +	/* save rx timestamp and originator for recvfrom() under lock.
> +	 * For an op subscribed on all interfaces (ifindex == 0)
> +	 * bcm_rx_handler() can run concurrently on different CPUs so
> +	 * the CAN content and the meta data must be bundled correctly.
> +	 */
> +	op->rx_stamp = skb->tstamp;
> +	op->rx_ifindex = skb->dev->ifindex;

[Severity: High]
This is a pre-existing issue, but does this unconditional update of
op->rx_stamp corrupt the timestamp metadata for throttled or multiplexed
CAN frames?

The commit message states that bcm_send_to_user() must report the timestamp
and ifindex of the very same frame whose content it is delivering. However, if
a BCM RX op is configured with a throttle timer, a CAN frame might match a
mask and get queued by the timer. If a second CAN frame arrives on the same
interface, it will unconditionally overwrite the shared op->rx_stamp here
before checking if the frame matches any multiplex index or if it will be
throttled.

When the throttle timer later flushes the first frame:

net/can/bcm.c:bcm_rx_thr_flush() {
    ...
    for (i = 1; i < op->nframes; i++)
        updated += bcm_rx_do_flush(op, i);
    ...
}

will all notifications use the single, overwritten op->rx_stamp from the
subsequent frame, rather than the timestamp of the frame actually being
delivered?

> +
>  	if (op->flags & RX_FILTER_ID) {
>  		/* the easiest case */
>  		bcm_rx_update_and_send(op, op->last_frames, rxframe,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-bcm_fixes-v11-0-067ba11bec5c@hartkopp.net?part=10