Re: [PATCH net 08/14] can: skb: make echo skb freeing safe in any IRQ context
From: sashiko-bot@kernel.org
Date: 2026-08-27 12:10:52
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Unsafe kfree_skb() call in SKB validation drop paths from hardirq disabled context. -- commit e51772559e06a8eadc0f2ac2b7cdadfcaeb3e18b Author: Cunhao Lu [off-list ref] can: skb: make echo skb freeing safe in any IRQ context can_put_echo_skb() can be called with hardware interrupts disabled. Its direct drop paths use kfree_skb(), while can_create_echo_skb() uses kfree_skb() when cloning fails and consume_skb() after a successful clone. None of these helpers is safe in every IRQ context. Link: https://patch.msgid.link/tencent_E84809CF236D0137885E7E4E4D58340B3208@qq.com
quoted hunk ↗ jump to hunk
diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c index 4f7a189de265d..0ed8057a3cb2c 100644 --- a/drivers/net/can/dev/skb.c +++ b/drivers/net/can/dev/skb.c@@ -63,7 +63,7 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, (skb->protocol != htons(ETH_P_CAN) && skb->protocol != htons(ETH_P_CANFD) && skb->protocol != htons(ETH_P_CANXL))) { - kfree_skb(skb); + dev_kfree_skb_any(skb); return 0; }@@ -91,7 +91,7 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, } else { /* locking problem with netif_stop_queue() ?? */ netdev_err(dev, "%s: BUG! echo_skb %d is occupied!\n", __func__, idx); - kfree_skb(skb); + dev_kfree_skb_any(skb); return -EBUSY; }diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h index a70a029670711..78c5870e2f9a2 100644 --- a/include/linux/can/skb.h +++ b/include/linux/can/skb.h@@ -76,12 +76,12 @@ static inline struct sk_buff *can_create_echo_skb(struct sk_buff *skb) nskb = skb_clone(skb, GFP_ATOMIC); if (unlikely(!nskb)) { - kfree_skb(skb); + dev_kfree_skb_any(skb); return NULL; } can_skb_set_owner(nskb, skb->sk); - consume_skb(skb); + dev_consume_skb_any(skb); return nskb; }
[Severity: High]
This is a pre-existing issue, but since this patch fixes context violations
in can_put_echo_skb() (which is called from ndo_start_xmit with hardirqs
disabled, e.g. via netpoll), does it make sense to fix the identical
violations in the adjacent CAN drop paths?
When a CAN driver's ndo_start_xmit rejects an invalid packet, it calls
can_dev_dropped_skb(), which still uses the IRQ-unsafe kfree_skb():
include/linux/can/dev.h:can_dev_dropped_skb() {
...
invalid_skb:
kfree_skb(skb);
dev->stats.tx_dropped++;
return true;
}
Similarly, can_dropped_invalid_skb() drops invalid SKBs using kfree_skb(),
which can trigger a kernel oops or context warning if called when hardirqs
are disabled:
drivers/net/can/dev/skb.c:can_dropped_invalid_skb() {
...
inval_skb:
kfree_skb(skb);
dev->stats.tx_dropped++;
return true;
}
Can these pre-existing drop paths also be updated to use dev_kfree_skb_any()
to prevent crashes when malformed packets are transmitted while netpoll is
active?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260826121036.2706424-1-mkl@pengutronix.de?part=8