Re: [PATCH v12 10/11] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Delayed or multiplexed frames report the timestamp and ifindex of newer unchanged or unmatched frames instead of the actual frame being delivered.
--

--- Patch [10]: [PATCH v12 10/11] can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() ---
commit f0e124b25a2c7cb08e57d4a9731711a9b77bf578
Author: Oliver Hartkopp <socketcan@hartkopp.net>

can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()

This commit fixes a data race by moving the assignments of op->rx_stamp and
op->rx_ifindex inside the bcm_rx_update_lock spinlock section. This ensures
concurrent writes on different CPUs do not tear the 64-bit timestamp.

Link: https://lore.kernel.org/linux-can/20260707145135.5BC831F00A3A@smtp.kernel.org/

> diff --git a/net/can/bcm.c b/net/can/bcm.c
> index fbf1cbb7c99fe..10a883b50fc63 100644
> --- a/net/can/bcm.c
> +++ b/net/can/bcm.c

[ ... ]

> @@ -815,6 +810,14 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
>  			traffic_flags |= RX_OWN;
>  	}
>  
> +	/* save rx timestamp and originator for recvfrom() under lock.
> +	 * For an op subscribed on all interfaces (ifindex == 0)
> +	 * bcm_rx_handler() can run concurrently on different CPUs so
> +	 * the CAN content and the meta data must be bundled correctly.
> +	 */
> +	op->rx_stamp = skb->tstamp;
> +	op->rx_ifindex = skb->dev->ifindex;
> +

[Severity: High]
This is a pre-existing issue, but does unconditionally overwriting the
metadata here decouple the payload from its true origin?

If a frame matches the CAN ID but fails the MUX filter later in this
function (or has an unchanged payload when using a throttle timer), it is
ignored. However, the rx_stamp and rx_ifindex fields are still updated.

Later, when the throttle timer flushes the pending frame via
bcm_send_to_user(), could it deliver the pending payload using the corrupted
metadata of the ignored frame instead of the actual frame being sent?

>  	if (op->flags & RX_FILTER_ID) {
>  		/* the easiest case */
>  		bcm_rx_update_and_send(op, op->last_frames, rxframe,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709-bcm_fixes-v12-0-61c06291bf1c@hartkopp.net?part=10