can: bcm: add missing rcu read protection for procfs content
authorOliver Hartkopp <socketcan@hartkopp.net>
Mon, 19 May 2025 12:50:27 +0000 (14:50 +0200)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Mon, 19 May 2025 14:58:19 +0000 (16:58 +0200)
commitdac5e6249159ac255dad9781793dbe5908ac9ddb
tree6fb3fc8ab8b768b22493a8c760cebc732cc812ed
parentc2aba69d0c36a496ab4f2e81e9c2b271f2693fd7
can: bcm: add missing rcu read protection for procfs content

When the procfs content is generated for a bcm_op which is in the process
to be removed the procfs output might show unreliable data (UAF).

As the removal of bcm_op's is already implemented with rcu handling this
patch adds the missing rcu_read_lock() and makes sure the list entries
are properly removed under rcu protection.

Fixes: f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly synchronize_rcu()")
Reported-by: Anderson Nascimento <anderson@allelesecurity.com>
Suggested-by: Anderson Nascimento <anderson@allelesecurity.com>
Tested-by: Anderson Nascimento <anderson@allelesecurity.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20250519125027.11900-2-socketcan@hartkopp.net
Cc: stable@vger.kernel.org # >= 5.4
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
net/can/bcm.c