can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op()
with call_rcu() and introduced the RX_NO_AUTOTIMER flag.

However, this flag check was omitted for thrtimer in the packet rx
fast-path. During BCM RX operation teardown, a concurrent RCU reader
(bcm_rx_handler) can race and re-arm thrtimer via
bcm_rx_update_and_send() after call_rcu() has been scheduled.  Once
the RCU grace period elapses, bcm_op is freed.  The subsequently
firing thrtimer then dereferences the deallocated op, causing a UAF.

Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not
fully close the TOCTOU race and introduces latency for every CAN frame.
Conversely, calling hrtimer_cancel() directly inside the RCU callback
(softirq context) is fatal as hrtimer_cancel() can sleep, triggering
a "scheduling while atomic" panic.

Resolve this by deferring the timer cancellation and memory free to a
dedicated unbound workqueue (bcm_wq).  The RCU callback now queues a
work item to bcm_wq, which safely cancels both timers and deallocates
memory in sleepable process context.  A dedicated workqueue is used to
prevent system-wide WQ saturation and is cleanly flushed/destroyed
on module unload to avoid rmmod page faults.

Since the deferred work can now outlive the calling context by an
unbounded amount, also take a reference on op->sk when it is assigned
and drop it only once the deferred work has cancelled both timers, so a
socket can no longer be freed out from under a still-armed timer whose
callback (bcm_send_to_user()) dereferences op->sk.

Fixes: f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()")
Tested-by: Feng Xue <feng.xue@outlook.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-1-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

diff --git a/net/can/bcm.c b/net/can/bcm.c
index a4bef2c48a559cf7b0fa1d00d1fb1187e31359d8..bdf53241bd7b3d68eaec0b43b15f18c03595ca3e 100644 (file)
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -58,6 +58,7 @@
 #include <linux/can/skb.h>
 #include <linux/can/bcm.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
 #include <linux/spinlock.h>
 #include <net/can.h>
 #include <net/sock.h>
@@ -92,6 +93,8 @@ MODULE_ALIAS("can-proto-2");
 
 #define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
 
+static struct workqueue_struct *bcm_wq;
+
 /*
  * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
  * 64 bit aligned so the offset has to be multiples of 8 which is ensured
@@ -105,6 +108,7 @@ static inline u64 get_u64(const struct canfd_frame *cp, int offset)
 struct bcm_op {
        struct list_head list;
        struct rcu_head rcu;
+       struct work_struct work;
        int ifindex;
        canid_t can_id;
        u32 flags;
@@ -793,9 +797,12 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
        return NULL;
 }
 
-static void bcm_free_op_rcu(struct rcu_head *rcu_head)
+static void bcm_free_op_work(struct work_struct *work)
 {
-       struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
+       struct bcm_op *op = container_of(work, struct bcm_op, work);
+
+       hrtimer_cancel(&op->timer);
+       hrtimer_cancel(&op->thrtimer);
 
        if ((op->frames) && (op->frames != &op->sframe))
                kfree(op->frames);
@@ -803,9 +810,23 @@ static void bcm_free_op_rcu(struct rcu_head *rcu_head)
        if ((op->last_frames) && (op->last_frames != &op->last_sframe))
                kfree(op->last_frames);
 
+       /* the last possible access to op->timer/op->thrtimer has now
+        * happened above via hrtimer_cancel() - op->sk is no longer
+        * needed by any pending timer callback, so drop our reference
+        */
+       sock_put(op->sk);
+
        kfree(op);
 }
 
+static void bcm_free_op_rcu(struct rcu_head *rcu_head)
+{
+       struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
+
+       INIT_WORK(&op->work, bcm_free_op_work);
+       queue_work(bcm_wq, &op->work);
+}
+
 static void bcm_remove_op(struct bcm_op *op)
 {
        hrtimer_cancel(&op->timer);
@@ -1060,6 +1081,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
                /* bcm_can_tx / bcm_tx_timeout_handler needs this */
                op->sk = sk;
+               sock_hold(sk);
                op->ifindex = ifindex;
 
                /* initialize uninitialized (kzalloc) structure */
@@ -1221,6 +1243,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
                /* bcm_can_tx / bcm_tx_timeout_handler needs this */
                op->sk = sk;
+               sock_hold(sk);
                op->ifindex = ifindex;
 
                /* ifindex for timeout events w/o previous frame reception */
@@ -1839,11 +1862,15 @@ static int __init bcm_module_init(void)
 {
        int err;
 
+       bcm_wq = alloc_workqueue("can-bcm-wq", WQ_UNBOUND, 0);
+       if (!bcm_wq)
+               return -ENOMEM;
+
        pr_info("can: broadcast manager protocol\n");
 
        err = register_pernet_subsys(&canbcm_pernet_ops);
        if (err)
-               return err;
+               goto register_pernet_failed;
 
        err = register_netdevice_notifier(&canbcm_notifier);
        if (err)
@@ -1861,6 +1888,8 @@ register_proto_failed:
        unregister_netdevice_notifier(&canbcm_notifier);
 register_notifier_failed:
        unregister_pernet_subsys(&canbcm_pernet_ops);
+register_pernet_failed:
+       destroy_workqueue(bcm_wq);
        return err;
 }
 
@@ -1869,6 +1898,8 @@ static void __exit bcm_module_exit(void)
        can_proto_unregister(&bcm_can_proto);
        unregister_netdevice_notifier(&canbcm_notifier);
        unregister_pernet_subsys(&canbcm_pernet_ops);
+       rcu_barrier();
+       destroy_workqueue(bcm_wq);
 }
 
 module_init(bcm_module_init);