Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Sat, 19 Jun 2021 22:12:38 +0200
From:   Marc Kleine-Budde <mkl@pengutronix.de>
To:     Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Cc:     linux-can@vger.kernel.org,
        Oliver Hartkopp <socketcan@hartkopp.net>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com,
        Norbert Slusarek <nslusarek@gmx.net>
Subject: Re: [PATCH] can: bcm: delay release of struct bcm_op after
 synchronize_rcu
Message-ID: <20210619201238.isat2vojezfkfndf@pengutronix.de>
References: <20210619161813.2098382-1-cascardo@canonical.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="mgigocquvvi3aw7a"
Content-Disposition: inline
In-Reply-To: <20210619161813.2098382-1-cascardo@canonical.com>
Precedence: bulk


--mgigocquvvi3aw7a
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 19.06.2021 13:18:13, Thadeu Lima de Souza Cascardo wrote:
> can_rx_register callbacks may be called concurrently to the call to
> can_rx_unregister. The callbacks and callback data, though, are protected=
 by
> RCU and the struct sock reference count.
>=20
> So the callback data is really attached to the life of sk, meaning that it
> should be released on sk_destruct. However, bcm_remove_op calls tasklet_k=
ill,
> and RCU callbacks may be called under RCU softirq, so that cannot be used=
 on
> kernels before the introduction of HRTIMER_MODE_SOFT.
>=20
> However, bcm_rx_handler is called under RCU protection, so after calling
> can_rx_unregister, we may call synchronize_rcu in order to wait for any R=
CU
> read-side critical sections to finish. That is, bcm_rx_handler won't be c=
alled
> anymore for those ops. So, we only free them, after we do that synchroniz=
e_rcu.
>=20
> Reported-by: syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com
> Reported-by: Norbert Slusarek <nslusarek@gmx.net>
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

Added to linux-can/testing.

Thanks,
Marc

--=20
Pengutronix e.K.                 | Marc Kleine-Budde           |
Embedded Linux                   | https://www.pengutronix.de  |
Vertretung West/Dortmund         | Phone: +49-231-2826-924     |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-5555 |

--mgigocquvvi3aw7a
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEK3kIWJt9yTYMP3ehqclaivrt76kFAmDOT7MACgkQqclaivrt
76lDQAf/aep/tGDob6DaLHc5aJhktFcJfqkXx1PwdEIQEve0WIEdLxHu9uYlFK4H
T+Yg/I1A2dtovq+SeWsRkKFDwNpQKRUQ78RjTozr0gs7dIQNNb2NwAb4d5Hywtux
rfbN1YaNOJYisLLqlLTARr9kez16pWnahuJIM8kS/HFkwCOn/pzuzWJDC6oYFfBQ
o3pMRgeZ0FWJH1RkfPbcRGCrdN+UX9dZ04F5muCLOUjqsP1r5mO47iRbkD+qTwKv
OoyhQrZedww2TZlyb/4P5j3aY6kGLGL/wAEA3EMBB9dWVHsgxjqwfH+ohIXbgiAw
nwkdGXDVHtB3SJEsgBxcux9U8dQ8pw==
=56Ct
-----END PGP SIGNATURE-----

--mgigocquvvi3aw7a--