[PATCH] can: raw: add locking for raw flags bitfield

[PATCH] can: raw: add locking for raw flags bitfield

[Oliver Hartkopp]

With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in
struct raw_sock") the formerly separate integer values have been integrated
into a single bitfield. This led to a read-modify-write operation when
changing a flag in raw_setsockopt() which now needs a locking to prevent
concurrent access.

Instead of adding a lock/unlock hell in each of the flag manipulations this
patch introduces a wrapper for a new raw_setsockopt_locked() function
analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c

Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock")
Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Tested-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
---
 net/can/raw.c | 66 +++++++++++++++++++++++----------------------------
 1 file changed, 30 insertions(+), 36 deletions(-)

diff --git a/net/can/raw.c b/net/can/raw.c
index a26942e78e68..82d9c0499c95 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -560,12 +560,12 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
 	addr->can_ifindex = ro->ifindex;
 
 	return RAW_MIN_NAMELEN;
 }
 
-static int raw_setsockopt(struct socket *sock, int level, int optname,
-			  sockptr_t optval, unsigned int optlen)
+static int raw_setsockopt_locked(struct socket *sock, int optname,
+				 sockptr_t optval, unsigned int optlen)
 {
 	struct sock *sk = sock->sk;
 	struct raw_sock *ro = raw_sk(sk);
 	struct can_filter *filter = NULL;  /* dyn. alloc'ed filters */
 	struct can_filter sfilter;         /* single filter */
@@ -573,13 +573,10 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 	can_err_mask_t err_mask = 0;
 	int count = 0;
 	int flag;
 	int err = 0;
 
-	if (level != SOL_CAN_RAW)
-		return -EINVAL;
-
 	switch (optname) {
 	case CAN_RAW_FILTER:
 		if (optlen % sizeof(struct can_filter) != 0)
 			return -EINVAL;
 
@@ -596,21 +593,15 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 		} else if (count == 1) {
 			if (copy_from_sockptr(&sfilter, optval, sizeof(sfilter)))
 				return -EFAULT;
 		}
 
-		rtnl_lock();
-		lock_sock(sk);
-
 		dev = ro->dev;
-		if (ro->bound && dev) {
-			if (dev->reg_state != NETREG_REGISTERED) {
-				if (count > 1)
-					kfree(filter);
-				err = -ENODEV;
-				goto out_fil;
-			}
+		if (ro->bound && dev && dev->reg_state != NETREG_REGISTERED) {
+			if (count > 1)
+				kfree(filter);
+			return -ENODEV;
 		}
 
 		if (ro->bound) {
 			/* (try to) register the new filters */
 			if (count == 1)
@@ -620,11 +611,11 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 				err = raw_enable_filters(sock_net(sk), dev, sk,
 							 filter, count);
 			if (err) {
 				if (count > 1)
 					kfree(filter);
-				goto out_fil;
+				return err;
 			}
 
 			/* remove old filter registrations */
 			raw_disable_filters(sock_net(sk), dev, sk, ro->filter,
 					    ro->count);
@@ -640,15 +631,10 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 			ro->dfilter = sfilter;
 			filter = &ro->dfilter;
 		}
 		ro->filter = filter;
 		ro->count  = count;
-
- out_fil:
-		release_sock(sk);
-		rtnl_unlock();
-
 		break;
 
 	case CAN_RAW_ERR_FILTER:
 		if (optlen != sizeof(err_mask))
 			return -EINVAL;
@@ -656,42 +642,30 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 		if (copy_from_sockptr(&err_mask, optval, optlen))
 			return -EFAULT;
 
 		err_mask &= CAN_ERR_MASK;
 
-		rtnl_lock();
-		lock_sock(sk);
-
 		dev = ro->dev;
-		if (ro->bound && dev) {
-			if (dev->reg_state != NETREG_REGISTERED) {
-				err = -ENODEV;
-				goto out_err;
-			}
-		}
+		if (ro->bound && dev && dev->reg_state != NETREG_REGISTERED)
+			return -ENODEV;
 
 		/* remove current error mask */
 		if (ro->bound) {
 			/* (try to) register the new err_mask */
 			err = raw_enable_errfilter(sock_net(sk), dev, sk,
 						   err_mask);
 
 			if (err)
-				goto out_err;
+				return err;
 
 			/* remove old err_mask registration */
 			raw_disable_errfilter(sock_net(sk), dev, sk,
 					      ro->err_mask);
 		}
 
 		/* link new err_mask to the socket */
 		ro->err_mask = err_mask;
-
- out_err:
-		release_sock(sk);
-		rtnl_unlock();
-
 		break;
 
 	case CAN_RAW_LOOPBACK:
 		if (optlen != sizeof(flag))
 			return -EINVAL;
@@ -767,10 +741,30 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 		return -ENOPROTOOPT;
 	}
 	return err;
 }
 
+static int raw_setsockopt(struct socket *sock, int level, int optname,
+			  sockptr_t optval, unsigned int optlen)
+{
+	struct sock *sk = sock->sk;
+	int err;
+
+	if (level != SOL_CAN_RAW)
+		return -EINVAL;
+
+	rtnl_lock();
+	lock_sock(sk);
+
+	err = raw_setsockopt_locked(sock, optname, optval, optlen);
+
+	release_sock(sk);
+	rtnl_unlock();
+
+	return err;
+}
+
 static int raw_getsockopt(struct socket *sock, int level, int optname,
 			  sockopt_t *opt)
 {
 	struct sock *sk = sock->sk;
 	struct raw_sock *ro = raw_sk(sk);
-- 
2.53.0

Re: [PATCH] can: raw: add locking for raw flags bitfield

[Vincent Mailhol]

On Mon. 4 May 2026 at 13:31, Oliver Hartkopp <socketcan@hartkopp.net> wrote:
> With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in
> struct raw_sock") the formerly separate integer values have been integrated
> into a single bitfield. This led to a read-modify-write operation when
> changing a flag in raw_setsockopt() which now needs a locking to prevent
> concurrent access.
>
> Instead of adding a lock/unlock hell in each of the flag manipulations this
> patch introduces a wrapper for a new raw_setsockopt_locked() function
> analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c
>
> Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock")

Arg, that's my patch, sorry for that!

> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>

Maybe add a link to the report?

Link: https://lore.kernel.org/linux-can/20260503112200.22727-1-eulgyukim@snu.ac.kr/

> Tested-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>

I was able to trigger the bug locally using Eulgyu minimum reproducer
and I can confirm that the issue is correctly resolved by this patch.
I also think that globally holding the lock simplifies the logic. I
tried to think if there were any alternatives (like
READ_ONCE()/WRITE_ONCE() or atomic types) but none of these seem
applicable here.

Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Tested-by: Vincent Mailhol <mailhol@kernel.org>


Yours sincerely,
Vincent Mailhol

Re: [PATCH] can: raw: add locking for raw flags bitfield

[Oliver Hartkopp]

Hello Vincent!

On 06.05.26 12:22, Vincent Mailhol wrote:
> On Mon. 4 May 2026 at 13:31, Oliver Hartkopp <socketcan@hartkopp.net> wrote:
>> With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in
>> struct raw_sock") the formerly separate integer values have been integrated
>> into a single bitfield. This led to a read-modify-write operation when
>> changing a flag in raw_setsockopt() which now needs a locking to prevent
>> concurrent access.
>>
>> Instead of adding a lock/unlock hell in each of the flag manipulations this
>> patch introduces a wrapper for a new raw_setsockopt_locked() function
>> analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c
>>
>> Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock")
> 
> Arg, that's my patch, sorry for that!

No problem. I did realize this either o_O

>> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> 
> Maybe add a link to the report?
> 
> Link: https://lore.kernel.org/linux-can/20260503112200.22727-1-eulgyukim@snu.ac.kr/

Good idea. In fact checkpatch.pl said "Reported-by: should be 
immediately followed by Closes: with a URL to the report"

So it should be

Closes: 
https://lore.kernel.org/linux-can/20260503112200.22727-1-eulgyukim@snu.ac.kr/

>> Tested-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
>> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
> 
> I was able to trigger the bug locally using Eulgyu minimum reproducer
> and I can confirm that the issue is correctly resolved by this patch.
> I also think that globally holding the lock simplifies the logic. I
> tried to think if there were any alternatives (like
> READ_ONCE()/WRITE_ONCE() or atomic types) but none of these seem
> applicable here.
> 
> Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
> Tested-by: Vincent Mailhol <mailhol@kernel.org>

Thanks Vincent!

Best regards,
Oliver

Re: [PATCH] can: raw: add locking for raw flags bitfield

[Marc Kleine-Budde]

[-- Attachment #1: Type: text/plain, Size: 1192 bytes --]

On 04.05.2026 13:19:28, Oliver Hartkopp wrote:
> With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in
> struct raw_sock") the formerly separate integer values have been integrated
> into a single bitfield. This led to a read-modify-write operation when
> changing a flag in raw_setsockopt() which now needs a locking to prevent
> concurrent access.
>
> Instead of adding a lock/unlock hell in each of the flag manipulations this
> patch introduces a wrapper for a new raw_setsockopt_locked() function
> analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c
>
> Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock")
> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> Tested-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>

Applied with Closes tag instead of Link after Reported-by.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]