[PATCH can-next] can: raw: take rtnl_lock() before leaving the notifier list

[PATCH can-next] can: raw: take rtnl_lock() before leaving the notifier list

[Oliver Hartkopp]

raw_release() removes the socket from raw_notifier_list before it takes
rtnl_lock(). As the netdev notifier chain runs under RTNL, a socket that
leaves the list in this window is skipped by raw_notify(). This is not
harmful for raw as the filters are removed with dev_net(ro->dev) under
RTNL, but the receivers may briefly remain on a device that has already
been moved to another namespace.

Align raw_release() with the isotp and bcm fixes for the same window and
take rtnl_lock() before removing the socket from the notifier list. As
raw_busy_notifier can not point to the released socket under RTNL,
replace the busy-wait loop with a WARN_ON_ONCE().

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 net/can/raw.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/can/raw.c b/net/can/raw.c
index 0acd4f6c6dd6..925c0c1d243f 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -420,20 +420,21 @@ static int raw_release(struct socket *sock)
 		return 0;
 
 	ro = raw_sk(sk);
 	net = sock_net(sk);
 
+	rtnl_lock();
+
+	/* The netdev notifier chain runs under RTNL, so raw_notifier() can't
+	 * be walking raw_notifier_list and point to this socket. The spinlock
+	 * is still needed as raw_init() adds sockets without holding RTNL.
+	 */
 	spin_lock(&raw_notifier_lock);
-	while (raw_busy_notifier == ro) {
-		spin_unlock(&raw_notifier_lock);
-		schedule_timeout_uninterruptible(1);
-		spin_lock(&raw_notifier_lock);
-	}
+	WARN_ON_ONCE(raw_busy_notifier == ro);
 	list_del(&ro->notifier);
 	spin_unlock(&raw_notifier_lock);
 
-	rtnl_lock();
 	lock_sock(sk);
 
 	/* remove current filters & unregister */
 	if (ro->bound) {
 		if (ro->dev) {
-- 
2.53.0