From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8216344605F; Tue, 21 Jul 2026 22:21:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672495; cv=none; b=KBgWzMgAJpf4TdJXnuWYTuuuHatm7K6pJLi9Z9Sw4kKXIxJumOhVDH/OF33+lEdzqN50RRqu22UpUH9j9X+cNsowIjJePSiM7CT3/zuGgq6HWdwVIOkQLXIRGRCQ48ZbWYrouDWEwrKFzbI1Ek7IESmn+VTkRnWPPCU0TY1iAKw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672495; c=relaxed/simple; bh=SFA12fm54HEzlOlPhDmxrAToKzaIy6S5dmgo1dIqYh4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tU6DvwXLlO428nYFGoOjSYK5RVIHALtHnghBB5iS2dUbseLl/n6Wg4s3ubl/YRaUC2ANtu1oKDQLxfnbxiDDfPN538CPevrbN8B9E8hSs9XvZiPvYbtW+pv/Cq90N/MwRSyIvSs0q3U+BJ7t4P24r0vRC7wrxWfMjtVflhcWdy0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CSvUxRZ8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="CSvUxRZ8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E85BB1F00A3A; Tue, 21 Jul 2026 22:21:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784672494; bh=92Rr9wYTR3UkNpSw6KTv9eL0pzEJNsZjJ6V6NZV2msw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CSvUxRZ8Axr5YoVi6jgNNvGwbMkRkeNwZXzPfxXlBHz++X6M9JmMwbfijZFPpuOuZ GaSJ29K8aMCrKN98VZ/iPzO8/Zs7jZhzQhNBUA+mCPFx7QZeAUS+vTuEx18hCcPn4P xxqvyNzRgICLHR3Jn3QHQuzkA7Ou0cVsFQu3dfEQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Nico Yip , Oliver Hartkopp , stable@kernel.org, Marc Kleine-Budde Subject: [PATCH 5.15 647/843] can: isotp: use unconditional synchronize_rcu() in isotp_release() Date: Tue, 21 Jul 2026 17:24:42 +0200 Message-ID: <20260721152420.622277721@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152405.946368001@linuxfoundation.org> References: <20260721152405.946368001@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Oliver Hartkopp commit 9b1a02e0d980ac6b0e36a90378f847062f81d7e4 upstream. isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister() and clears so->bound without waiting for a grace period. isotp_release() uses so->bound to decide whether it needs to call synchronize_rcu() before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it skips that synchronize_rcu() and can cancel the timer while an in-flight isotp_rcv() is still executing and about to re-arm it via isotp_send_fc(), leading to a use-after-free timer callback on the freed socket. sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(), therefore make isotp_release() always call synchronize_rcu() before cancelling the timers, regardless of so->bound. This still closes the original race (isotp_notify() clearing so->bound without waiting for in-flight isotp_rcv() callers before isotp_release() cancels the RX timer) without adding any RCU wait to the netdevice notifier path. Fixes: 14a4696bc311 ("can: isotp: isotp_release(): omit unintended hrtimer restart on socket release") Closes: https://lore.kernel.org/linux-can/20260707085210.6B6C01F000E9@smtp.kernel.org/ Reported-by: Nico Yip Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20260712-isotp-fixes-v10-1-793a1b1ce17f@hartkopp.net Cc: stable@kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- net/can/isotp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -1184,11 +1184,18 @@ static int isotp_release(struct socket * SINGLE_MASK(so->txid), isotp_rcv_echo, sk); dev_put(dev); - synchronize_rcu(); } } } + /* Always wait for a grace period before touching the timers below. + * A concurrent NETDEV_UNREGISTER may have already unregistered our + * filters and cleared so->bound in isotp_notify() without waiting + * for in-flight isotp_rcv() callers to finish, so this call must not + * be skipped just because so->bound is already 0 here. + */ + synchronize_rcu(); + hrtimer_cancel(&so->txfrtimer); hrtimer_cancel(&so->txtimer); hrtimer_cancel(&so->rxtimer);