Re: [PATCH net 2/6] can: bcm: prevent thrtimer UAF in rx path by checking RX_NO_AUTOTIMER

[Lee Jones <lee@kernel.org>]

On Wed, 13 May 2026, Marc Kleine-Budde wrote:

> On 13.05.2026 14:59:13, Lee Jones wrote:
> > On Fri, 08 May 2026, Jakub Kicinski wrote:
> >
> > > On Thu,  7 May 2026 10:22:24 +0200 Marc Kleine-Budde wrote:
> > > > Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
> > > > synchronize_rcu()") removed the synchronize_rcu() call from
> > > > bcm_delete_rx_op() and introduced the RX_NO_AUTOTIMER flag to prevent
> > > > timers from being rearmed during deletion.  However, it only applied
> > > > this check to op->timer via bcm_rx_starttimer().
> > >
> > > All AIs point out this is insufficient:
> > >
> > >     reader (bcm_rx_handler, RCU) | writer (bcm_delete_rx_op)
> > >     -----------------------------+-------------------------------
> > >     test op->flags (no AUTOTIMER)|
> > >                                  | op->flags |= RX_NO_AUTOTIMER
> > >                                  | bcm_remove_op()
> > >                                  |   hrtimer_cancel(&op->thrtimer)
> > >                                  |     /* not armed: no-op */
> > >                                  | call_rcu(bcm_free_op_rcu)
> > >     hrtimer_start(&op->thrtimer) |
> > >     return from RCU section      |
> > >                                  | grace period elapses
> > >                                  | bcm_free_op_rcu() -> kfree(op)
> > >     thrtimer fires               |
> > >       bcm_rx_thr_handler(op)     | <-- UAF
> >
> > Noted.  Leave it with me and I'll follow up shortly.
> 
> Please send a new patch against net-next/main, I'll drop this one.

Wilco - working on it now.

-- 
Lee Jones