From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCD1244605F; Tue, 21 Jul 2026 22:21:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672501; cv=none; b=bAKZoeSstcD5/18bp6gn/IvuIjT8Hr2Vbl35coutKOpP0xrJKS2Xp2DjlgJ5gR/jG2uTA8fzvpA9RJvS/64Z2U7HZ3FQeeHH3CVukWP/t5wb0XiBRKApxvEnrYw7Og+08VpOxCEf3Rb0glx8hH0cnxnR1/CPAzZ5l9ufLMKG6cM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672501; c=relaxed/simple; bh=dNNdeQT8LIZ10uAuGfc5ABCEcuMx1ejJ8in1OgK4rxA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W4zxAO7GOP41qYIhzy7b93zismV+/9JKvKA7AgWzSv/EX1uWG2xp3Ow9FJ6X7LApXxMhARLOD0RK1R9hvnA9x1HGYatj6lx+6nOTiVOxpTMrsWZ8VKzEGeDxvS9q1K0oY5ehNS8VsciVAB1IJfBBUc1WhEKpzPwP+XdoksIq0PI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=GCeFup1V; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="GCeFup1V" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D86C1F000E9; Tue, 21 Jul 2026 22:21:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784672499; bh=NVijzOZOySx+g3AlQM3x18jOPZBowSN3iSE3KA9YzYQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GCeFup1VImymeYdfeU4uBxBWWS8tT+hzsoQguXTV1rHxk3JahZgcOM4n1Fd/Zf3kJ 2LTkFuXRPnwU1SrdKt0gnAchRYOTF773awD+9AxkShLOFii/MFcyVcldABjRNv9hkM Si/d4+dU077x8w85XYvFooiPIrGT6gDJm8pcK/8E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-reviews@lists.linux.dev, Oliver Hartkopp , stable@kernel.org, Marc Kleine-Budde Subject: [PATCH 5.15 649/843] can: bcm: add missing rcu list annotations and operations Date: Tue, 21 Jul 2026 17:24:44 +0200 Message-ID: <20260721152420.668676558@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152405.946368001@linuxfoundation.org> References: <20260721152405.946368001@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Hartkopp commit 7b2c3eabc4dafc062a25e10711154f2107526a78 upstream. sashiko-bot remarked the missing use of list_add_rcu() in bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure when bcm_proc_show() traverses the bcm_op's under rcu_read_lock(). To cover all initial settings of the bcm_op's the list_add_rcu() calls are moved to the end of the setup code. While at it, also fix the mirroring removal side: bcm_release() called bcm_remove_op() - which frees the op via call_rcu() - on ops that were still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first. Unlink each op with list_del_rcu() before handing it to bcm_remove_op(), matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op(). Reported-by: sashiko-reviews@lists.linux.dev Closes: https://lore.kernel.org/linux-can/20260610094654.A1FFE1F00893@smtp.kernel.org/ Fixes: dac5e6249159 ("can: bcm: add missing rcu read protection for procfs content") Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260714-bcm_fixes-v15-5-562f7e3e42da@hartkopp.net Cc: stable@kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- net/can/bcm.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -244,7 +244,7 @@ static int bcm_proc_show(struct seq_file (reduction == 100) ? "near " : "", reduction); } - list_for_each_entry(op, &bo->tx_ops, list) { + list_for_each_entry_rcu(op, &bo->tx_ops, list) { seq_printf(m, "tx_op: %03X %s ", op->can_id, bcm_proc_getifname(net, ifname, op->ifindex)); @@ -877,6 +877,7 @@ static int bcm_tx_setup(struct bcm_msg_h struct bcm_sock *bo = bcm_sk(sk); struct bcm_op *op; struct canfd_frame *cf; + bool add_op_to_list = false; unsigned int i; int err; @@ -1018,8 +1019,7 @@ static int bcm_tx_setup(struct bcm_msg_h hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_SOFT); - /* add this bcm_op to the list of the tx_ops */ - list_add(&op->list, &bo->tx_ops); + add_op_to_list = true; } /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */ @@ -1041,6 +1041,10 @@ static int bcm_tx_setup(struct bcm_msg_h op->flags |= TX_ANNOUNCE; } + /* add this bcm_op to the list of the tx_ops? */ + if (add_op_to_list) + list_add_rcu(&op->list, &bo->tx_ops); + if (op->flags & TX_ANNOUNCE) bcm_can_tx(op); @@ -1183,9 +1187,6 @@ static int bcm_rx_setup(struct bcm_msg_h HRTIMER_MODE_REL_SOFT); op->thrtimer.function = bcm_rx_thr_handler; - /* add this bcm_op to the list of the rx_ops */ - list_add(&op->list, &bo->rx_ops); - /* call can_rx_register() */ do_rx_register = 1; @@ -1264,10 +1265,12 @@ static int bcm_rx_setup(struct bcm_msg_h bcm_rx_handler, op, "bcm", sk); if (err) { /* this bcm rx op is broken -> remove it */ - list_del_rcu(&op->list); bcm_remove_op(op); return err; } + + /* add this bcm_op to the list of the rx_ops */ + list_add_rcu(&op->list, &bo->rx_ops); } return msg_head->nframes * op->cfsiz + MHSIZ; @@ -1597,8 +1600,10 @@ static int bcm_release(struct socket *so remove_proc_entry(bo->procname, net->can.bcmproc_dir); #endif /* CONFIG_PROC_FS */ - list_for_each_entry_safe(op, next, &bo->tx_ops, list) + list_for_each_entry_safe(op, next, &bo->tx_ops, list) { + list_del_rcu(&op->list); bcm_remove_op(op); + } list_for_each_entry_safe(op, next, &bo->rx_ops, list) { /* @@ -1629,8 +1634,10 @@ static int bcm_release(struct socket *so synchronize_rcu(); - list_for_each_entry_safe(op, next, &bo->rx_ops, list) + list_for_each_entry_safe(op, next, &bo->rx_ops, list) { + list_del_rcu(&op->list); bcm_remove_op(op); + } /* remove device reference */ if (bo->bound) {