Subject: Re: [PATCH net 2/6] can: bcm: prevent thrtimer UAF in rx path by checking RX_NO_AUTOTIMER

From: Lee Jones <[email-masked]>
Date: Wed, 13 May 2026 14:59:13 +0100

On Fri, 08 May 2026, Jakub Kicinski wrote:

> On Thu,  7 May 2026 10:22:24 +0200 Marc Kleine-Budde wrote:
> > Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
> > synchronize_rcu()") removed the synchronize_rcu() call from
> > bcm_delete_rx_op() and introduced the RX_NO_AUTOTIMER flag to prevent
> > timers from being rearmed during deletion.  However, it only applied
> > this check to op->timer via bcm_rx_starttimer().
> 
> All AIs point out this is insufficient:
> 
>     reader (bcm_rx_handler, RCU) | writer (bcm_delete_rx_op)
>     -----------------------------+-------------------------------
>     test op->flags (no AUTOTIMER)|
>                                  | op->flags |= RX_NO_AUTOTIMER
>                                  | bcm_remove_op()
>                                  |   hrtimer_cancel(&op->thrtimer)
>                                  |     /* not armed: no-op */
>                                  | call_rcu(bcm_free_op_rcu)
>     hrtimer_start(&op->thrtimer) |
>     return from RCU section      |
>                                  | grace period elapses
>                                  | bcm_free_op_rcu() -> kfree(op)
>     thrtimer fires               |
>       bcm_rx_thr_handler(op)     | <-- UAF

Noted.  Leave it with me and I'll follow up shortly.

-- 
Lee Jones