[PATCH net 02/19] can: esd_usb: kill anchored URBs before freeing netdevs

[PATCH net 02/19] can: esd_usb: kill anchored URBs before freeing netdevs

[Marc Kleine-Budde]

From: Fan Wu <fanwu01@zju.edu.cn>

esd_usb_disconnect() frees each CAN netdev with free_candev() inside
its per-netdev loop and only calls unlink_all_urbs(dev) afterwards.
The per-netdev private data (struct esd_usb_net_priv) is embedded in
the net_device allocation returned by alloc_candev(), so once
free_candev() has run, dev->nets[i] points to freed memory.
unlink_all_urbs() then dereferences the freed dev->nets[i] to kill the
per-netdev TX anchor (usb_kill_anchored_urbs(&priv->tx_submitted)),
clear active_tx_jobs, and reset priv->tx_contexts[].

Reorder the teardown so the anchored URBs are killed before the netdevs
are freed, matching other CAN/USB drivers in the same directory such as
ems_usb, usb_8dev and mcba_usb, which unregister, then unlink, then
free: unregister the netdevs first (which stops their TX queues), call
unlink_all_urbs(dev) once, then free the netdevs.

This issue was found by an in-house static analysis tool.

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260709164159.497640-1-fanwu01@zju.edu.cn
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 drivers/net/can/usb/esd_usb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
index d257440fa01f..f41d4a0d140f 100644
--- a/drivers/net/can/usb/esd_usb.c
+++ b/drivers/net/can/usb/esd_usb.c
@@ -1390,10 +1390,13 @@ static void esd_usb_disconnect(struct usb_interface *intf)
 				netdev = dev->nets[i]->netdev;
 				netdev_info(netdev, "unregister\n");
 				unregister_netdev(netdev);
-				free_candev(netdev);
 			}
 		}
 		unlink_all_urbs(dev);
+		for (i = 0; i < dev->net_count; i++) {
+			if (dev->nets[i])
+				free_candev(dev->nets[i]->netdev);
+		}
 		kfree(dev);
 	}
 }
-- 
2.53.0

Re: [PATCH net 03/19] can: raw: add locking for raw flags bitfield

[Oliver Hartkopp]

Upstream commit 1e5185c090589f4146d728ab36417d8a5419f127

is missing in stable.

Best regards,
Oliver

On 16.07.26 17:47, Marc Kleine-Budde wrote:
> From: Oliver Hartkopp <socketcan@hartkopp.net>
> 
> With commit 890e5198a6e5 ("can: raw: use bitfields to store flags in
> struct raw_sock") the formerly separate integer values have been integrated
> into a single bitfield. This led to a read-modify-write operation when
> changing a flag in raw_setsockopt() which now needs a locking to prevent
> concurrent access.
> 
> Instead of adding a lock/unlock hell in each of the flag manipulations this
> patch introduces a wrapper for a new raw_setsockopt_locked() function
> analogue to the isotp_setsockopt[_locked]() approach in net/can/isotp.c
> 
> Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct raw_sock")
> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> Closes: https://lore.kernel.org/linux-can/20260503112200.22727-1-eulgyukim@snu.ac.kr/
> Tested-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
> Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
> Tested-by: Vincent Mailhol <mailhol@kernel.org>
> Link: https://patch.msgid.link/20260504111928.41856-1-socketcan@hartkopp.net
> [mkl: use Closes tag instead of Link]
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
> ---
>   net/can/raw.c | 66 +++++++++++++++++++++++----------------------------
>   1 file changed, 30 insertions(+), 36 deletions(-)
> 
> diff --git a/net/can/raw.c b/net/can/raw.c
> index a26942e78e68..82d9c0499c95 100644
> --- a/net/can/raw.c
> +++ b/net/can/raw.c
> @@ -562,8 +562,8 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
>   	return RAW_MIN_NAMELEN;
>   }
>   
> -static int raw_setsockopt(struct socket *sock, int level, int optname,
> -			  sockptr_t optval, unsigned int optlen)
> +static int raw_setsockopt_locked(struct socket *sock, int optname,
> +				 sockptr_t optval, unsigned int optlen)
>   {
>   	struct sock *sk = sock->sk;
>   	struct raw_sock *ro = raw_sk(sk);
> @@ -575,9 +575,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   	int flag;
>   	int err = 0;
>   
> -	if (level != SOL_CAN_RAW)
> -		return -EINVAL;
> -
>   	switch (optname) {
>   	case CAN_RAW_FILTER:
>   		if (optlen % sizeof(struct can_filter) != 0)
> @@ -598,17 +595,11 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   				return -EFAULT;
>   		}
>   
> -		rtnl_lock();
> -		lock_sock(sk);
> -
>   		dev = ro->dev;
> -		if (ro->bound && dev) {
> -			if (dev->reg_state != NETREG_REGISTERED) {
> -				if (count > 1)
> -					kfree(filter);
> -				err = -ENODEV;
> -				goto out_fil;
> -			}
> +		if (ro->bound && dev && dev->reg_state != NETREG_REGISTERED) {
> +			if (count > 1)
> +				kfree(filter);
> +			return -ENODEV;
>   		}
>   
>   		if (ro->bound) {
> @@ -622,7 +613,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   			if (err) {
>   				if (count > 1)
>   					kfree(filter);
> -				goto out_fil;
> +				return err;
>   			}
>   
>   			/* remove old filter registrations */
> @@ -642,11 +633,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   		}
>   		ro->filter = filter;
>   		ro->count  = count;
> -
> - out_fil:
> -		release_sock(sk);
> -		rtnl_unlock();
> -
>   		break;
>   
>   	case CAN_RAW_ERR_FILTER:
> @@ -658,16 +644,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   
>   		err_mask &= CAN_ERR_MASK;
>   
> -		rtnl_lock();
> -		lock_sock(sk);
> -
>   		dev = ro->dev;
> -		if (ro->bound && dev) {
> -			if (dev->reg_state != NETREG_REGISTERED) {
> -				err = -ENODEV;
> -				goto out_err;
> -			}
> -		}
> +		if (ro->bound && dev && dev->reg_state != NETREG_REGISTERED)
> +			return -ENODEV;
>   
>   		/* remove current error mask */
>   		if (ro->bound) {
> @@ -676,7 +655,7 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   						   err_mask);
>   
>   			if (err)
> -				goto out_err;
> +				return err;
>   
>   			/* remove old err_mask registration */
>   			raw_disable_errfilter(sock_net(sk), dev, sk,
> @@ -685,11 +664,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   
>   		/* link new err_mask to the socket */
>   		ro->err_mask = err_mask;
> -
> - out_err:
> -		release_sock(sk);
> -		rtnl_unlock();
> -
>   		break;
>   
>   	case CAN_RAW_LOOPBACK:
> @@ -769,6 +743,26 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
>   	return err;
>   }
>   
> +static int raw_setsockopt(struct socket *sock, int level, int optname,
> +			  sockptr_t optval, unsigned int optlen)
> +{
> +	struct sock *sk = sock->sk;
> +	int err;
> +
> +	if (level != SOL_CAN_RAW)
> +		return -EINVAL;
> +
> +	rtnl_lock();
> +	lock_sock(sk);
> +
> +	err = raw_setsockopt_locked(sock, optname, optval, optlen);
> +
> +	release_sock(sk);
> +	rtnl_unlock();
> +
> +	return err;
> +}
> +
>   static int raw_getsockopt(struct socket *sock, int level, int optname,
>   			  sockopt_t *opt)
>   {

Re: [PATCH net 03/19] can: raw: add locking for raw flags bitfield

[Greg KH]

On Sun, Jul 26, 2026 at 10:08:52AM +0200, Oliver Hartkopp wrote:
> Upstream commit 1e5185c090589f4146d728ab36417d8a5419f127
> 
> is missing in stable.

Which stable?  And why wasn't this tagged for stable inclusion to start
with?

thanks,

greg k-h

Re: [PATCH net 03/19] can: raw: add locking for raw flags bitfield

[Oliver Hartkopp]

On 26.07.26 13:17, Greg KH wrote:
> On Sun, Jul 26, 2026 at 10:08:52AM +0200, Oliver Hartkopp wrote:
>> Upstream commit 1e5185c090589f4146d728ab36417d8a5419f127
>>
>> is missing in stable.
> 
> Which stable?  And why wasn't this tagged for stable inclusion to start
> with?

This patch fixes commit 890e5198a6e5b238627c245fafea1a92670a86cd ("can: 
raw: use bitfields to store flags in struct raw_sock") introduced in 6.18:

$ git tag --contains 890e5198a6e5b238627c245fafea1a92670a86cd | head -1
v6.18

So it would be needed for 6.18 and never.

I thought the tag

Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct 
raw_sock")

would automatically tag this patch for stable with AUTOSEL.

Unfortunately there was no Cc: stable in the commit message. No idea why.

Best regards,
Oliver

Re: [PATCH net 03/19] can: raw: add locking for raw flags bitfield

[Greg KH]

On Sun, Jul 26, 2026 at 09:45:09PM +0200, Oliver Hartkopp wrote:
> 
> 
> On 26.07.26 13:17, Greg KH wrote:
> > On Sun, Jul 26, 2026 at 10:08:52AM +0200, Oliver Hartkopp wrote:
> > > Upstream commit 1e5185c090589f4146d728ab36417d8a5419f127
> > > 
> > > is missing in stable.
> > 
> > Which stable?  And why wasn't this tagged for stable inclusion to start
> > with?
> 
> This patch fixes commit 890e5198a6e5b238627c245fafea1a92670a86cd ("can: raw:
> use bitfields to store flags in struct raw_sock") introduced in 6.18:
> 
> $ git tag --contains 890e5198a6e5b238627c245fafea1a92670a86cd | head -1
> v6.18
> 
> So it would be needed for 6.18 and never.
> 
> I thought the tag
> 
> Fixes: 890e5198a6e5 ("can: raw: use bitfields to store flags in struct
> raw_sock")
> 
> would automatically tag this patch for stable with AUTOSEL.

Never rely on AUTOSEL if you know you want a patch merged, please just
follow the documentation for how to get a stable patch merged:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

thanks,

greg k-h