Re: [PATCH net 08/14] can: skb: make echo skb freeing safe in any IRQ context

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe kfree_skb() call in SKB validation drop paths from hardirq disabled context.
--

commit e51772559e06a8eadc0f2ac2b7cdadfcaeb3e18b
Author: Cunhao Lu <1579567540@qq.com>

can: skb: make echo skb freeing safe in any IRQ context

can_put_echo_skb() can be called with hardware interrupts disabled. Its
direct drop paths use kfree_skb(), while can_create_echo_skb() uses
kfree_skb() when cloning fails and consume_skb() after a successful clone.
None of these helpers is safe in every IRQ context.

Link: https://patch.msgid.link/tencent_E84809CF236D0137885E7E4E4D58340B3208@qq.com

> diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
> index 4f7a189de265d..0ed8057a3cb2c 100644
> --- a/drivers/net/can/dev/skb.c
> +++ b/drivers/net/can/dev/skb.c
> @@ -63,7 +63,7 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
>  	    (skb->protocol != htons(ETH_P_CAN) &&
>  	     skb->protocol != htons(ETH_P_CANFD) &&
>  	     skb->protocol != htons(ETH_P_CANXL))) {
> -		kfree_skb(skb);
> +		dev_kfree_skb_any(skb);
>  		return 0;
>  	}
>  
> @@ -91,7 +91,7 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
>  	} else {
>  		/* locking problem with netif_stop_queue() ?? */
>  		netdev_err(dev, "%s: BUG! echo_skb %d is occupied!\n", __func__, idx);
> -		kfree_skb(skb);
> +		dev_kfree_skb_any(skb);
>  		return -EBUSY;
>  	}
>  
> diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
> index a70a029670711..78c5870e2f9a2 100644
> --- a/include/linux/can/skb.h
> +++ b/include/linux/can/skb.h
> @@ -76,12 +76,12 @@ static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb)
>  
>  	nskb = skb_clone(skb, GFP_ATOMIC);
>  	if (unlikely(!nskb)) {
> -		kfree_skb(skb);
> +		dev_kfree_skb_any(skb);
>  		return NULL;
>  	}
>  
>  	can_skb_set_owner(nskb, skb->sk);
> -	consume_skb(skb);
> +	dev_consume_skb_any(skb);
>  	return nskb;
>  }

[Severity: High]
This is a pre-existing issue, but since this patch fixes context violations
in can_put_echo_skb() (which is called from ndo_start_xmit with hardirqs
disabled, e.g. via netpoll), does it make sense to fix the identical
violations in the adjacent CAN drop paths?

When a CAN driver's ndo_start_xmit rejects an invalid packet, it calls
can_dev_dropped_skb(), which still uses the IRQ-unsafe kfree_skb():

include/linux/can/dev.h:can_dev_dropped_skb() {
    ...
invalid_skb:
	kfree_skb(skb);
	dev->stats.tx_dropped++;
	return true;
}

Similarly, can_dropped_invalid_skb() drops invalid SKBs using kfree_skb(),
which can trigger a kernel oops or context warning if called when hardirqs
are disabled:

drivers/net/can/dev/skb.c:can_dropped_invalid_skb() {
    ...
inval_skb:
	kfree_skb(skb);
	dev->stats.tx_dropped++;
	return true;
}

Can these pre-existing drop paths also be updated to use dev_kfree_skb_any()
to prevent crashes when malformed packets are transmitted while netpoll is
active?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826121036.2706424-1-mkl@pengutronix.de?part=8