From nobody Fri Sep 25 23:54:04 2026 Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazon11013062.outbound.protection.outlook.com [52.101.83.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 402AF4078D3; Mon, 7 Sep 2026 10:49:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.83.62 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788778200; cv=fail; b=OF3eqG7MDWGTGoLaIDfKSINnNsSlPX5YQTCjj907/lH1U7fROMERl52sMHvlXfed2j5plvxWLceQh91YBC8k0+ZTdtdPYSHuID6dYDgmIfcQkKMwoDyc331DWva8B953XZH594IHKyA41XbyyZJdVFWcgCkmEDR0C9BgXGLSwgI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788778200; c=relaxed/simple; bh=aPpCgWG3aYyF5Auwtcx23U1ci+YVFxyD9frh6YtcOZw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=BwPaqYUt0RxaYm2BNRcZEH/Tmcf0dTxib48xmZ25w8rB7+19osBOv6y9b8q0sXEVsmhmQO60arXLSOAbttwrejVjF61MtbKYJKBbuumGVMZxtFT/jr7/KYrG+SLGZyNluCiJzTagRbptNvZO7E7c1pPJIU4saXXn8jv/u7igcP8= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.nxp.com; spf=pass smtp.mailfrom=oss.nxp.com; dkim=pass (2048-bit key) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b=O+9eAljM; arc=fail smtp.client-ip=52.101.83.62 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.nxp.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.nxp.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b="O+9eAljM" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tCPYrTA/vy/aZgHE1qKy8qpCtNUKLSqo/FgDT3WCaFb6p8IknuegEqx6GwniJd5b9T+8sLUoes7LXr1Bl5R5TSwclLcAtH8G8cvGPnQ1PDcqcrxhyUzCepQaQNqZTu8cXckt9h2l6/u6mZw4vZpJoBCN3xoYxIHAysO/T7Csv7yrVLsGoLHtsUFrdYBDLW8KtMp7VGfZAdnUKFkr+recYi53Gg91yccOHsxtM9vfu1a5LoQwQG0qLYMoXtFwfCKhIsaE5WwWHvR5Wgt6CMbWZvLprxl7rRXICbZ9psh14lbCjQxdolYrDuQkOxMspQn8VwZH3SlH3EVjxSUTaDvxaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ui2LZy02JFlVW0P1xpWSvQV2qqf1SWSzWcCL4wlV0V0=; b=E3vPSuKZkgUC7x1aPz3rdnoTG5ggp2v0zCVfDvAtN6++f/4wi7oNMGSm6ilzStvPmWbrRSi4s8b6UwsIbnDcluucxlPzhrXqfAOcqSccss/mK38+uxVvwq2kpP8W9c1/mYpeW4BJ90Yz2QZJ/3aLmrOH+lM/HBoCTy5MWoW3QFAbSdybiiqvVwxPoLCJjpGNYFCZhRQdZEvqVBboVc6gGhckMbwwhonVopkQjtLz7KaXOx7Af1vZviGOngKpzkBgmj5F8zZAiSVXcVDhE9fUCCZW5JK40vI6hjpMhtrJkeTG5BgE51+qYSjAbS+PJNS90lzK2mp19LtHDWdqC4a3Yg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oss.nxp.com; dmarc=pass action=none header.from=oss.nxp.com; dkim=pass header.d=oss.nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NXP1.onmicrosoft.com; s=selector1-NXP1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ui2LZy02JFlVW0P1xpWSvQV2qqf1SWSzWcCL4wlV0V0=; b=O+9eAljMD1XDZZv/PhTV63oKgE3sYCJKLILskdKsAcvwxZFR4IU7Rtk2zTvdPDpxCY9itTiO/D0vJe42btGAB9rmrxQqCO8cA3Ch1LWGk10JGx8MfrTnt4myl8NZS5Vkfz6Y2oZ9R9V0qgfcJXOpgEKDAA2xhB/WHSEw70709ouM+x3LXk31LQjgn6JzIr1eDPworlqc/iQXzXJn5ijn/xCZvehW7J25u1ZbPnS7Paivz+JfcI61BhhNyyaJC9BrA0154BMAgL7BrByQHq3n9sxBjbMwbgeaIsg6cTNEKOWEX+Q7d8j7vt9krAkUXXhOzmrXIFyBrI3j5oKN37sc9g== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=oss.nxp.com; Received: from AM0PR04MB5858.eurprd04.prod.outlook.com (2603:10a6:208:132::23) by DBBPR04MB7578.eurprd04.prod.outlook.com (2603:10a6:10:208::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 10:49:45 +0000 Received: from AM0PR04MB5858.eurprd04.prod.outlook.com ([fe80::bdf4:c9d1:4e3f:68c6]) by AM0PR04MB5858.eurprd04.prod.outlook.com ([fe80::bdf4:c9d1:4e3f:68c6%3]) with mapi id 15.21.0382.007; Mon, 7 Sep 2026 10:49:45 +0000 From: Ciprian Costea To: Marc Kleine-Budde , Vincent Mailhol , Nicolas Ferre , Alexandre Belloni , Claudiu Beznea , Kurt Van Dijck Cc: linux-can@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, NXP S32 Linux Team , Ciprian Marian Costea , Haibo Chen Subject: [PATCH v5 1/3] can: rx-offload: make skb_irq_queue per-CPU Date: Mon, 7 Sep 2026 12:49:40 +0200 Message-ID: <20260907104942.17089-2-ciprianmarian.costea@oss.nxp.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907104942.17089-1-ciprianmarian.costea@oss.nxp.com> References: <20260907104942.17089-1-ciprianmarian.costea@oss.nxp.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: FR0P281CA0138.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:96::7) To AM0PR04MB5858.eurprd04.prod.outlook.com (2603:10a6:208:132::23) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM0PR04MB5858:EE_|DBBPR04MB7578:EE_ X-MS-Office365-Filtering-Correlation-Id: dcb41ed7-1fc8-4a3e-f7f0-08df0ccdbb2b X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|19092799006|7416014|11063799006|56012099006|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: iMpMSz+xVRdI6nH+GjqnYWrTa0Cs448x1P+ki3OOP709H66yH/n8/mJ6x04nN7ZQqhsFS8gM2OfcsgseZBFaWtTKUpv/NIuEgi00W9Y4XCbcXnwT5jAKBpk4Fnum2MJoDzhNL3FdmSQdOw277v/XsQz/Ai2gxdh169C9e9Dty2DSSZtULcjV+q3d6lW3efIR1WARM8x28j5qlAnAkoe0mCxy45eObAvNL6LKGFk1puRWwh7cPIrSTM6m0zjbhDfyTZIGQLyPbgc5jr6nGhcs/4SHu5VaUEGKQwyqETIYxZASywcMzQnnjYmVPtjscubF3kUCsCq3ksPc4jP2qxPg0Y1agVYBVUzoB3m7vWV/j05wPaeY5DNsCpmlTWRRkN5KcAhkqu0JmcN34Micv535nyiSBxpxAFXz9XUjMs4CiewBJIu5I0n/HVBG36TKIMoh2JLaQlSGYN4O5BeUqsiPUaBCA8XbRThKmm4C+/2fUR4lM38ZUjoBYEBq1Rlhk2xOonSALs48e6lXRFHGQpItbqhksqFcVhy3CtECfqCLcAOPdL5WhnCaMZ58lZxbH7SHKPxuFVh/6072PpgLbrvOzi+6drPQEbT6aYlEWdt+PAfhaixw+cMOpK1eAtyVGumg7dk7IPw5On/WbO2tMeVX48KY8jswNMzjlYvd+yNErrk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR04MB5858.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(19092799006)(7416014)(11063799006)(56012099006)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Uk1XK051VCtIeTRIU2tlK1FGdExKZEJ1ejFISzJ2V2VVZUlMa2tYTUZFT2hJ?= =?utf-8?B?eXhjaXIwQ1NZU2NTcC9oTjZ3QzFPa1FsTDgzVlVlY3Rab2lMS1MzNFhaM2NO?= =?utf-8?B?WksySlZ5NGJydEhRRjZnajRFQVoxOHlVajNWMEhxTWhqRFo4MHlhS1YyR1RV?= =?utf-8?B?Y29QdHppaTJNUlhjMjhDbnN5NDBteERQOTJwSG4wK1l0WjlBWm9nYy9jNTdZ?= =?utf-8?B?WG9hc21YYVc1MmxwczgrNEg3K3o4ci8zTnQyanZINkg2Z2dUQy9aV2RDNisy?= =?utf-8?B?ZHVBQ0w2Ui9BWnpZa3BCMXZxZ0dXc256bTFMVFRyOTcxMkxHSDJEeEdXa0dU?= =?utf-8?B?K0RBSVpoTWV3QlNVcDdlbW9HZEdDQmhub1ZQVDMvTFZXSE1oMmtjVk9xNFJE?= =?utf-8?B?cXEwVWIvWmxYS3dwMFBIUW5ZdzEzb3h1T0RPN21hbG5Fblo5cTRZTkNGNXZo?= =?utf-8?B?K2tIdGgrVWhVbkFBZ2todW9DRFJ2aWs1NTBrS056cml2TXVxcm9seXpNRnpO?= =?utf-8?B?cVM5NnlxNGwwN0RLempWdXFqYkFFdXoxSGl1eWZhcDhXRFlKUGlTdWluM0M0?= =?utf-8?B?em40WEF3THN3d0Z0MHQ0Mnh1elViSTVPTTFhOFAzSXhzSEluV2RKcVBRRWZD?= =?utf-8?B?bnpkSk5zTXV6OXhMTGp3QTRxbVRSTTFyS21lT0RrdG5ITTdDblJwSTRiVlpK?= =?utf-8?B?dXI3QW5rcjVPYjdUNGlxNm5DQWtVRW53c3p6UDBLa3Y3b0U5V2VWdDk0QTBC?= =?utf-8?B?ZUVORW8zb3ZrYVRmT1JVMVNkamJxWEtmdkJWYzhoalEyaUhYRmFpRHJ0aWIv?= =?utf-8?B?dkQ4RnprYXpUQm5NTHBZQkoxSFpxNitVWjdmVVdJa2ZBSVNvbTBRN3ZDUWpI?= =?utf-8?B?bzM1Y01jWGd4WktORjFaMVMvRHFhWUlVeUY1cUU3UGdER05IckVkZFBpcDVS?= =?utf-8?B?OTE2WXFTcmJ4RTJIRGw4ZGk4Qnk1Mndyb2pnRFEwbTZIeXd3ZHRSd2JKRGZK?= =?utf-8?B?NnU0b1dBUk4wdmpqR0U3NE1XTjBmWDlpZ25IcnJIM0toTTRIZ3pSUTVHWlh0?= =?utf-8?B?TXdmTkhsbG1RREZLTG5VcklYVjhWR0JJVEdpOERCZEhLakxBRWpQWkdUb3pL?= =?utf-8?B?M2NWRkErYTBuU09hZk9xM1cyemNXSXlLUnF3TlVadEhpUlRGT1VQU1pHMGJI?= =?utf-8?B?SW9LcHVPT3dXc3RKb3ZXMDNJZ0dSZENSTE9tZXZNY0l0aThyUERhSUdGQ294?= =?utf-8?B?QkJ2RU9nQkkrbUw5cExZajAvWDFtcVp3UFJ4UVhwVW4wZ2xqM3dKY0w3Qzly?= =?utf-8?B?enhaMDlJaE54Q0owMjJwVkQ2TlZveDR4K2NuRUk1endhWWNTTjRtN29zd1Fi?= =?utf-8?B?UUh1T3U5RUdDLzA4UzZ6RjNvMWlwb3JEdC85ZEVoYWIzeldMOHNwT3o5TlJr?= =?utf-8?B?TG01Qkh3SUMyaUFlcGoxRUthN3l3dVpib3d1cUtpTlR1MnlITDVMR1N3RkhG?= =?utf-8?B?ellxWDZxdnU1dmI3dVZDVEpQVUhMWkV0ZVZpTkEzZDhiNWs5TXZqRDlNTHUz?= =?utf-8?B?SVlMdUF4M2RrWTY3TUdGV3U4Q3hsUmpqZUdob2tUTEdKTHltUmFkSlNUazhR?= =?utf-8?B?OTZ2UFFCcUVkbFhqTHlmdDAzNitEVXRMeHliQjNjU05OODhTOTIrN1JRTjBP?= =?utf-8?B?Ui8xUzJVeHMyR3l6M0F2cnVFVTZvRUxpV3YwcG1ScnB5WDI4T25Kc0o3K2Vx?= =?utf-8?B?a3pNVEFrc3pSLytabk9ieGxIZ1d0TVljTVRRTDZ1UGM0WTEvVnhtblp2YnMr?= =?utf-8?B?SXcvTjUwZGdEYklHYXZPK1lVOXZJSlltVmFtZnllUUlpcldzcDd2eHRCMlI5?= =?utf-8?B?N3NjcFpuOFA1NnBGTVJYSHFyNVdZM0dHYnFBcmx3MkVNMkFNT2gycVNHc1Rl?= =?utf-8?B?cjJYaTNWVWczMGpRV2xQZjVLTTZCeDVYNUE0SlJGaEpHclVKR1RHdXFOczBP?= =?utf-8?B?eEc5cXFSQ1hWOXdWSWd1OTBEWVpRMHNqVGdocXlaSThlODhxRHhBVzhKTnoz?= =?utf-8?B?TGV1eFQ0RGgyMlNjcVhtTVdSeTVPTVpJL29yRStDcmcwRFd3OWNFMnBHUzdH?= =?utf-8?B?N2Y0SFN0NXp0K0syWkx4VzY1VTVxMU03SFhvMk5TM1BCRDhHM2dqa0VTRFk3?= =?utf-8?B?RlFUSjVSdndsdG9UQS84RERGSzJBQm9ueVhxNkZVTHpORjFqVXUyQnVuVTVu?= =?utf-8?B?d1V6WFJXRWdITU9GT3dReEtGcnAyc1c3QWtLSW5kYm9nLzR4ZCtDMjVtMjZB?= =?utf-8?B?SkxmMlUxUzJaZ1JtdDlJVkEwMlMzNTlaWjJMZm9oM0xBTk9leWZ1dXVqR2hN?= =?utf-8?Q?fhB0HOUZXKKIXsPY=3D?= X-OriginatorOrg: oss.nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: dcb41ed7-1fc8-4a3e-f7f0-08df0ccdbb2b X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB5858.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 10:49:45.9146 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: l4HDPYJ17OzliKFzNE05UKzuYL1ZZgtnrKOyRqgDU/jYFVg46EB+BqfAX+ciFFpfuvFIprZRt+ERMXVcJ956elvuAPaoS/SnynQop2LNXhM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR04MB7578 Content-Type: text/plain; charset="utf-8" From: Ciprian Marian Costea skb_irq_queue is filled by the IRQ handlers using the lockless __skb_queue_add_sort() / __skb_queue_tail() helpers and later spliced into skb_queue under skb_queue.lock by can_rx_offload_irq_finish() and can_rx_offload_threaded_irq_finish(). This is only safe while a single context fills skb_irq_queue. FlexCAN on NXP S32G2 (FLEXCAN_QUIRK_SECONDARY_MB_IRQ) uses two mailbox IRQ lines, one for MB0-7 and one for MB8-63; MCF5441X similarly splits its mailbox interrupt. When these lines are affined to different CPUs both handlers can run at the same time and enqueue into the same sk_buff_head concurrently, corrupting its list. Allocate skb_irq_queue per-CPU so the handlers no longer share a list, keeping the enqueue path lock-free. Access the per-CPU queue via get_cpu_ptr()/put_cpu_ptr() in the enqueue helpers: this disables preemption around the lockless __skb_queue_*() operation. can_rx_offload_irq_finish() runs in the same context as its enqueues and splices this_cpu_ptr(). can_rx_offload_threaded_irq_finish() may have been migrated after its enqueues, so it splices every possible CPU's queue; this is safe because each per-CPU queue has a single producer and that producer runs with preemption disabled, so it cannot race the splice. Cross-line frames are now sorted by timestamp only within a CPU's queue and appended across CPUs on splice; each skb keeps its own timestamp. Fixes: c757096ea103 ("can: rx-offload: add skb queue for use during ISR") Signed-off-by: Ciprian Marian Costea Reviewed-by: Haibo Chen --- drivers/net/can/dev/rx-offload.c | 88 +++++++++++++++++++++++++++----- include/linux/can/rx-offload.h | 2 +- 2 files changed, 75 insertions(+), 15 deletions(-) diff --git a/drivers/net/can/dev/rx-offload.c b/drivers/net/can/dev/rx-offl= oad.c index 46e7b6db4a1e..7616a16d9049 100644 --- a/drivers/net/can/dev/rx-offload.c +++ b/drivers/net/can/dev/rx-offload.c @@ -7,6 +7,7 @@ =20 #include #include +#include =20 struct can_rx_offload_cb { u32 timestamp; @@ -175,9 +176,18 @@ can_rx_offload_offload_one(struct can_rx_offload *offl= oad, unsigned int n) int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pending) { + struct sk_buff_head *irq_queue; unsigned int i; int received =3D 0; =20 + /* + * get_cpu_ptr() disables preemption so that the lockless + * __skb_queue_*() below operate on the current CPU's queue without + * racing a migration. This also keeps this_cpu_ptr() valid when a + * driver enqueues from a preemptible (threaded IRQ) context. + */ + irq_queue =3D get_cpu_ptr(offload->skb_irq_queue); + for (i =3D offload->mb_first; can_rx_offload_le(offload, i, offload->mb_last); can_rx_offload_inc(offload, &i)) { @@ -190,20 +200,25 @@ int can_rx_offload_irq_offload_timestamp(struct can_r= x_offload *offload, if (IS_ERR_OR_NULL(skb)) continue; =20 - __skb_queue_add_sort(&offload->skb_irq_queue, skb, + __skb_queue_add_sort(irq_queue, skb, can_rx_offload_compare); received++; } =20 + put_cpu_ptr(offload->skb_irq_queue); + return received; } EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_timestamp); =20 int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) { + struct sk_buff_head *irq_queue; struct sk_buff *skb; int received =3D 0; =20 + irq_queue =3D get_cpu_ptr(offload->skb_irq_queue); + while (1) { skb =3D can_rx_offload_offload_one(offload, 0); if (IS_ERR(skb)) @@ -211,10 +226,12 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_off= load *offload) if (!skb) break; =20 - __skb_queue_tail(&offload->skb_irq_queue, skb); + __skb_queue_tail(irq_queue, skb); received++; } =20 + put_cpu_ptr(offload->skb_irq_queue); + return received; } EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo); @@ -222,6 +239,7 @@ EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo); int can_rx_offload_queue_timestamp(struct can_rx_offload *offload, struct sk_buff *skb, u32 timestamp) { + struct sk_buff_head *irq_queue; struct can_rx_offload_cb *cb; =20 if (skb_queue_len(&offload->skb_queue) > @@ -233,8 +251,9 @@ int can_rx_offload_queue_timestamp(struct can_rx_offloa= d *offload, cb =3D can_rx_offload_get_cb(skb); cb->timestamp =3D timestamp; =20 - __skb_queue_add_sort(&offload->skb_irq_queue, skb, - can_rx_offload_compare); + irq_queue =3D get_cpu_ptr(offload->skb_irq_queue); + __skb_queue_add_sort(irq_queue, skb, can_rx_offload_compare); + put_cpu_ptr(offload->skb_irq_queue); =20 return 0; } @@ -268,13 +287,17 @@ EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb_queue_t= imestamp); int can_rx_offload_queue_tail(struct can_rx_offload *offload, struct sk_buff *skb) { + struct sk_buff_head *irq_queue; + if (skb_queue_len(&offload->skb_queue) > offload->skb_queue_len_max) { dev_kfree_skb_any(skb); return -ENOBUFS; } =20 - __skb_queue_tail(&offload->skb_irq_queue, skb); + irq_queue =3D get_cpu_ptr(offload->skb_irq_queue); + __skb_queue_tail(irq_queue, skb); + put_cpu_ptr(offload->skb_irq_queue); =20 return 0; } @@ -307,14 +330,15 @@ EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb_queue_t= ail); =20 void can_rx_offload_irq_finish(struct can_rx_offload *offload) { + struct sk_buff_head *irq_queue =3D this_cpu_ptr(offload->skb_irq_queue); unsigned long flags; int queue_len; =20 - if (skb_queue_empty_lockless(&offload->skb_irq_queue)) + if (skb_queue_empty_lockless(irq_queue)) return; =20 spin_lock_irqsave(&offload->skb_queue.lock, flags); - skb_queue_splice_tail_init(&offload->skb_irq_queue, &offload->skb_queue); + skb_queue_splice_tail_init(irq_queue, &offload->skb_queue); spin_unlock_irqrestore(&offload->skb_queue.lock, flags); =20 queue_len =3D skb_queue_len(&offload->skb_queue); @@ -330,15 +354,34 @@ void can_rx_offload_threaded_irq_finish(struct can_rx= _offload *offload) { unsigned long flags; int queue_len; - - if (skb_queue_empty_lockless(&offload->skb_irq_queue)) - return; - + int cpu; + + /* + * Splice every CPU's queue: unlike the non-threaded + * can_rx_offload_irq_finish(), a threaded handler may be migrated + * between the enqueue and this splice, so the frames may sit on a + * different CPU's queue. This is only safe because a given per-CPU + * queue has a single producer (the enqueue on that CPU is + * non-preemptible), so no producer can race this splice. + * + * This assumes a single threaded handler context per offload instance + * (IRQ requested with IRQF_ONESHOT / handler non-reentrant), so each + * per-CPU queue has exactly one producer. If that changes, this + * cross-CPU splice of lockless queues would need additional locking. + */ spin_lock_irqsave(&offload->skb_queue.lock, flags); - skb_queue_splice_tail_init(&offload->skb_irq_queue, &offload->skb_queue); + for_each_possible_cpu(cpu) { + struct sk_buff_head *irq_queue; + + irq_queue =3D per_cpu_ptr(offload->skb_irq_queue, cpu); + skb_queue_splice_tail_init(irq_queue, &offload->skb_queue); + } spin_unlock_irqrestore(&offload->skb_queue.lock, flags); =20 queue_len =3D skb_queue_len(&offload->skb_queue); + if (!queue_len) + return; + if (queue_len > offload->skb_queue_len_max / 8) netdev_dbg(offload->dev, "%s: queue_len=3D%d\n", __func__, queue_len); @@ -353,13 +396,21 @@ static int can_rx_offload_init_queue(struct net_devic= e *dev, struct can_rx_offload *offload, unsigned int weight) { + int cpu; + offload->dev =3D dev; =20 /* Limit queue len to 4x the weight (rounded to next power of two) */ offload->skb_queue_len_max =3D 2 << fls(weight); offload->skb_queue_len_max *=3D 4; skb_queue_head_init(&offload->skb_queue); - __skb_queue_head_init(&offload->skb_irq_queue); + + offload->skb_irq_queue =3D alloc_percpu(struct sk_buff_head); + if (!offload->skb_irq_queue) + return -ENOMEM; + + for_each_possible_cpu(cpu) + __skb_queue_head_init(per_cpu_ptr(offload->skb_irq_queue, cpu)); =20 netif_napi_add_weight(dev, &offload->napi, can_rx_offload_napi_poll, weight); @@ -420,8 +471,17 @@ EXPORT_SYMBOL_GPL(can_rx_offload_enable); =20 void can_rx_offload_del(struct can_rx_offload *offload) { + int cpu; + netif_napi_del(&offload->napi); skb_queue_purge(&offload->skb_queue); - __skb_queue_purge(&offload->skb_irq_queue); + + if (!offload->skb_irq_queue) + return; + + for_each_possible_cpu(cpu) + __skb_queue_purge(per_cpu_ptr(offload->skb_irq_queue, cpu)); + + free_percpu(offload->skb_irq_queue); } EXPORT_SYMBOL_GPL(can_rx_offload_del); diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h index d29bb4521947..1b9e2a8ab39a 100644 --- a/include/linux/can/rx-offload.h +++ b/include/linux/can/rx-offload.h @@ -20,7 +20,7 @@ struct can_rx_offload { bool drop); =20 struct sk_buff_head skb_queue; - struct sk_buff_head skb_irq_queue; + struct sk_buff_head __percpu *skb_irq_queue; u32 skb_queue_len_max; =20 unsigned int mb_first; --=20 2.43.0 From nobody Fri Sep 25 23:54:04 2026 Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazon11013062.outbound.protection.outlook.com [52.101.83.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6682E446C17; Mon, 7 Sep 2026 10:50:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.83.62 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788778203; cv=fail; b=AuTc3bB29QFb2FK8xkveo29py9VOK1cb4H+bKEj3zAs2B0GzMIX+bcGZS/2sKpXFc45dFjityIi/UXaT/AYN1u0vEKQUzL1wxw9dY+WjGWeopEziyqvX3eniiSOlyjIEmjVnrJuiQpHtZ6fKoyh8XBuP4Ul4xWQewEjM+7WV4jg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788778203; c=relaxed/simple; bh=LsMMtqRj3M0OWc3uEs6GojWNGvi7dfMNwtUn9xBZoDw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=X1ELG1Hy0hWPap08uDZ6+9TYNvLyUp3tPH4S6zCu+pWatp4aa1zRfBf0SYupagewhUMLMoY5Oa6LpR8QUEeQUvdmUUg2P7o2bYbak61pC94dKkBKLIBR7UhdPgvNN3WEJQOMjdGXkoqmyF15vZYLXHmp70um3nWnx1cx6XnjIGo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.nxp.com; spf=pass smtp.mailfrom=oss.nxp.com; dkim=pass (2048-bit key) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b=nlwcCSSP; arc=fail smtp.client-ip=52.101.83.62 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.nxp.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.nxp.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b="nlwcCSSP" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=U4ib7wmIjcE0HWSzpZZPmnTaDo0L1hkvgnfh90q0bnErWTBZKMkubUfHjR3+C1Q+Pu7BaFV/W0pLbpdwcqF+7CGYmGtuxRAUM22RfaxDWr+au6kj1awVIU2GeE/X8yC034k6SJm+V8/pMmTE2nx7FB4jZEgWEXH+lSRpto2fmd9v4cVjJL8v+r2LmfawF5KahxR13ypKRDi7iVBtILOqyhX2iQLvFtXRhWWCdNFlvi7BDD5j9bXCYm4ZAOJgiwz70B6N9lc7pkd+GbHSUsXaZGWye+gn7ZbNhAooaRKFWmvYDMbXB00MMUPDwxLeD/CcicxA5Be/qYn05PoH0YvODw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=uZMRLx2jnL+NjNb1tkWootG7u1lAvnyAwkpLwwFr6LY=; b=EgljJ1YhIWuBs5o0RaescVaRleXzLkW1UeaA+YaeWRd0qYvnCX9w97TLSImRwsfFyRjAbXzghWCTIB/Hy6gNLXFJ67GQhUJmUUPPb1wr4l3BK62RCwxYkCxsLiX3ABgaqMmP19Zx58Bsmp1Ugz3EODV0W1UB/0ffcpBX5TPryRocMJTCV5AHXvKe/YzOwtl9vDzNm5Ukq2bDr1AvQcNqcXo4m1YS+JqkcHVPHdi+cbV75Z7IOcySN/dYoXaN6sMaCAknE1Dwq6kx3mQTbp26bEDQOgmXGjIGMg/MPluX0TQWJm5zUm495/Y6WFVqRsiwVy0lH0C08xrcLqw0HrC1UQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oss.nxp.com; dmarc=pass action=none header.from=oss.nxp.com; dkim=pass header.d=oss.nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NXP1.onmicrosoft.com; s=selector1-NXP1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uZMRLx2jnL+NjNb1tkWootG7u1lAvnyAwkpLwwFr6LY=; b=nlwcCSSPTm1rD+k/65A7TE5Gh39Tu5+9sExQHGfj+PJWiOBC+o+bIgynA4uiTHyi3VnPU4GDK21rPciIyglkvtxKTlJ3ri4zFqy8S74rfADKN7wk4Jo5JyOK+kHRu2Q92gLy4iFG1LbEIfcY2zqFfsxAl0Z0Y4qZmcTSBC7veC7KrI4x/3oQqs6UvUcU6VkAE32BYlAT6YsAGKnhmJH5/Bn3Wcjd16c198YVV+d8BxlffEkgYSxmUcT04pUwczcQ17VAGddLwb35N3kNohYaOlGimUsAgVcmGp/2v/9pQMfH+3Y39gcoUWFKUuw/8fcoO564Zzks+CeK+yhJFNeF7A== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=oss.nxp.com; Received: from AM0PR04MB5858.eurprd04.prod.outlook.com (2603:10a6:208:132::23) by DBBPR04MB7578.eurprd04.prod.outlook.com (2603:10a6:10:208::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 10:49:47 +0000 Received: from AM0PR04MB5858.eurprd04.prod.outlook.com ([fe80::bdf4:c9d1:4e3f:68c6]) by AM0PR04MB5858.eurprd04.prod.outlook.com ([fe80::bdf4:c9d1:4e3f:68c6%3]) with mapi id 15.21.0382.007; Mon, 7 Sep 2026 10:49:47 +0000 From: Ciprian Costea To: Marc Kleine-Budde , Vincent Mailhol , Nicolas Ferre , Alexandre Belloni , Claudiu Beznea , Kurt Van Dijck Cc: linux-can@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, NXP S32 Linux Team , Ciprian Marian Costea Subject: [PATCH v5 2/3] can: at91_can: fix rx-offload cleanup on unbind and probe errors Date: Mon, 7 Sep 2026 12:49:41 +0200 Message-ID: <20260907104942.17089-3-ciprianmarian.costea@oss.nxp.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907104942.17089-1-ciprianmarian.costea@oss.nxp.com> References: <20260907104942.17089-1-ciprianmarian.costea@oss.nxp.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: FR0P281CA0145.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:96::18) To AM0PR04MB5858.eurprd04.prod.outlook.com (2603:10a6:208:132::23) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM0PR04MB5858:EE_|DBBPR04MB7578:EE_ X-MS-Office365-Filtering-Correlation-Id: fdb6e9d9-3fd1-45c5-348b-08df0ccdbbf4 X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|19092799006|7416014|11063799006|6133799003|56012099006|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: EhAcUarTbJPiXfK7Q3wPkGgnWMGn/vxnc/E9/JbXZ81T01U+dQEFi+9xaz5bQJ5hrjUkrX/wWOvdjarUYzEig2NsHB7nQeUkVEMCnmFsCZOS8oaKUM2tncGe/QRCfLjb1c3i6B1DDbWde4YyAUlZYW8tqy5hzNeboWSBpia/0FJtPt3QFjMEAvkoU7pYuJBSsciwZ8bN/ePgfYWGtyd74a4EoZk1I3QF734W5LH+J3GU2SS+jYj+/L6BnqqInPxUiN7LKZqwqMr+I5kf9C9QskTJb+sCCeIdWz60k9zIfud35LTVx6VmGCMqVJ3kUKsUDyLSzfmK8uZGn1P4DpDvl96pA/C5W2vQF7tisQtutAjxqvdz77lsvP+cmKoaD4Ko2ZB97J86f1sT8CVdsnvj1JI4s4bzo7key0q9OJC+Q4oRGyFZf7yCFhY4rUTd6vIElpWxzo6qrvFSSLqXlIY+O4pH236wew80wUaaSBVrRB2nxdqnoylPAwU/MDhn2A+XjkrwTqWYw4DI7NYe5pvYxh6f13URou1eA9lvfjrw894GB+L8CrtNY1j8+LsapqAtF2zowq79QQQCdvMB8YP4oRJzsrIQb4e6dXWMBjjFWhPFTV9JKmGMrL6vLCtDzl9sZe6lnl8OtJT5g91i0xfBRRxhgbWEndCwXdVNHRq22js= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR04MB5858.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(19092799006)(7416014)(11063799006)(6133799003)(56012099006)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?QTFEbGFtVGczZHViM2F0VWNCaHdvTWVXTHVBbWxPNHQxNXFGTlR5RUM1SS9H?= =?utf-8?B?UmVaVTRMK1NoaC9FdVdPaStLWWJLTGxTb1NtRkdVVFhRckN3RmhBQlRKcFJj?= =?utf-8?B?OXpGeWttOHpZRi9wL1h3NXl5MUdHbFZOR1hDNXFBUHI2NnJMaVk5Z3ZBUy9n?= =?utf-8?B?Z0ZoeVprZ1hnNkk0ZW9EYzQ1cFRodlMwMkVkbTVVdDRKeld2UmJacDZGNnl0?= =?utf-8?B?NzNWTm1BSi9VUU9rKzNxMUpWYm1aWXp1Q1V1ZUJhVHp4NVpONlI3bnhadjRK?= =?utf-8?B?TFdtQ0c1cEJiMzEzYnNxYm1OKzNFQzZsUTZ3cVJQdC92Ykt4Uy93dmdMU1Yy?= =?utf-8?B?MGhBZG53aG5MUjUyMGpKMVBLL0JleldVR3hlRDFzbUZIWEtobi9rWjhGKzlp?= =?utf-8?B?cmdOblpEY3hScTE0ZkY4c3NwVkIxY1puZXlZTEljckFvajNEK3VFcGQ1dnFN?= =?utf-8?B?WDREaVFNZmQ2dlNSNTJuZVVQazRuSEM3Vk5CdjVBS0paWWhTL3NzcENnTlFS?= =?utf-8?B?dUNLaUVjbEF2Yk5lWjBEUmIycXhlRVlsVzQyNFZGRGhmZ09reGNUM3AzQk9T?= =?utf-8?B?a3VlenJSVkd2V1FaWDJMVVk3cTVaWHV4RS85eDNlY2I3OWJsYThGa1NoQ0RR?= =?utf-8?B?Q3kzek5wdDdRbjVPK3BNdVpjK3Jldk1CbHpnNm90OWh2WFYwV1p4Vy9ZVDMw?= =?utf-8?B?d0Y0cmRNMVJKTGRUdWpCY3B5SFlJenpIZlAvbXlCNjRsRk9ibGJwUVFVWlJ0?= =?utf-8?B?cithNFVzU0RXREJIM012eS9Ldmh4LzM3MkFUTktpL1g1UmhiK09JRS9PYk16?= =?utf-8?B?cTBCVFdHNmlmRHpaOU5aN3JWUytqb3NVU2hucnNFUGg5M0xyR2doTUV4amR4?= =?utf-8?B?S0ozaERQSDBaMThuZXNHUnJsdWt1RWpjM1dXZFJWYXZTMU1kT3l1cEVWQkhh?= =?utf-8?B?citoMThRNmlLend6UTR3Ui8zd2JDeTdYTHBOZktYOVBCa0lpSzhvdEp2ZTFO?= =?utf-8?B?V1NWVFhxWTRsU2ZraFdHOVRDRFBrVTFaMXBLc2dFZ0VrWmpxTUpZTzhnSkZ1?= =?utf-8?B?UVZZd2xiSlUycE5LRTVjeHR5V0Q5bGVWdWd2VUNsTGFKeVozb3NpOS9RSFI5?= =?utf-8?B?aWxNSnliUUd4aHhxdzRRa0tJNFRoRXhYOUx3cFNURFlLWjdVZHVmZVBGTUgv?= =?utf-8?B?blI5SkIya1NpeFhiNDlJb1JHYlZtWmtSWm5HM3NLYlVBcWZUemttaTdoOUU4?= =?utf-8?B?R2VSME83OWc5R1FwWk5RcVowWkNhVVZURFRTMlVpSWsxOXZNSitJdEpPR1NS?= =?utf-8?B?Wm11Y1ZscXRlR3FsNXVCdjRMWFl3R2FmZk5hQ0s0UGtnZThGbmthcXJsNnNm?= =?utf-8?B?amtHMk5BWHFhQlE0d1J1UVhVU1B4NDV3ZDJrb01TZGZSY2lBZjh6bUFmcWgz?= =?utf-8?B?bThZb0tmV0NZNExtcVMyWlRwTHk3ZkU2cGphUjRKZUVLbWJRdk1pTmhSc1U1?= =?utf-8?B?TlZ1Qk05WDVVN1ZyN3BGUmtibUpocWQ2NUF1KzRjZ2x2VC9lbzc2M3FvUGdp?= =?utf-8?B?RnBlUjFXWVJtTDZ6U3gwVXR2MUVKN3lBT09HdGFHTGErME5ZbVpsdytxVnpm?= =?utf-8?B?d1E1VnozL1VqM2lsSjRQZ3VnOVF2aXJ5VVVJYmRpME5aYVV1UVNvWDRhY1Qx?= =?utf-8?B?Mm9xcFlGYlJIYzVvOUFiM0xNSWVGKzkrQmh3cmRMajlaejMybmg4WmV1SEMy?= =?utf-8?B?dk1EWFZ6ZXN1MHV2c1lvd3p6UmREYk8yQjFiVXlPbTdjYkw2S0dmbGo1d0NL?= =?utf-8?B?bTVjL1JmWEMwTXQ1QmltUTRRY0pISzNKa2F6N0ZOT1dlRG1SeUZwcldrY3dz?= =?utf-8?B?cGtqanMwbkhXVExXbmxubzV3NjJxK244T3h4WWR5VmtsZzRycWgxNGxuenhY?= =?utf-8?B?NzBaR0NJbkNSZXVIWFBRTUhRRmlPcUpRc2orUGl0cDBaR1ZsRnhNUXJ3b3E4?= =?utf-8?B?c21CRkxUU3FtZHI4WmNHZjRaT3NDRGdqQmJteUxIYnlFNEhaMXV2a0V2OTcx?= =?utf-8?B?OFE4cmFrZXBLQU9lbTR1NHZQQ3VYczUvYmNEemxneVhSeE5NWmxrMXM4Z3hZ?= =?utf-8?B?dGNRNVhTQ0t5NktUZDZDbVlUNW1ka2NRZ0lQUlNZcUR2eGRNLzVpUzJnZzcz?= =?utf-8?B?K0hJbERvUDFFNlh2cXhrNms1bUVMWWZiVmdhWEcwdlZvK2pJcy9PY3IwTXNG?= =?utf-8?B?ajh3U1k0MTdPangzdGZsRG8rd2c2dCsvdDdwTzNhVFUxNit3dkgwNjdNUGNG?= =?utf-8?B?WVNoM08zRkc3WTRzSkJXZDRZTFdMYXVYSkt4RHRTMmt4OHZNL3lsV09DMWhI?= =?utf-8?Q?V0srWtr4DSnWSb3o=3D?= X-OriginatorOrg: oss.nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: fdb6e9d9-3fd1-45c5-348b-08df0ccdbbf4 X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB5858.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 10:49:47.2292 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: IN+9cyzOwFf4WfTnuqR1ymSPT8R/eGXrXb+fGG4Z1GfPmX4TQwlN0i2g3+TcA8JKTpKXqOZQ6wvpMMYZ/jPvkVGvg17KUgTaUGTGQyvt6JQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR04MB7578 Content-Type: text/plain; charset="utf-8" From: Ciprian Marian Costea Making can_rx_offload's skb_irq_queue per-CPU (previous patch) adds an alloc_percpu() to can_rx_offload_add_*(). That allocation has to be freed on teardown and can fail with -ENOMEM, which exposes three problems in at91_can: - at91_can_remove() does not call can_rx_offload_del(), so the NAPI instance and the per-CPU queues are leaked on unbind and module removal. - The probe error path after a failed register_candev() jumps straight to free_candev() without can_rx_offload_del() and leaks the same objects. - The return value of can_rx_offload_add_timestamp() is ignored. It can now return -ENOMEM with offload->skb_irq_queue =3D=3D NULL, probe still succe= eds, and the first RX interrupt dereferences that NULL pointer in can_rx_offload_irq_offload_timestamp() via get_cpu_ptr(). Check the return value and call can_rx_offload_del() from at91_can_remove() and from a new error label taken when register_candev() fails. Fixes: 137f59d5dab4 ("can: at91_can: switch to rx-offload implementation") Signed-off-by: Ciprian Marian Costea --- drivers/net/can/at91_can.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c index 58da323f14d7..3f6c5bb373d3 100644 --- a/drivers/net/can/at91_can.c +++ b/drivers/net/can/at91_can.c @@ -1123,7 +1123,9 @@ static int at91_can_probe(struct platform_device *pde= v) priv->offload.mb_first =3D devtype_data->rx_first; priv->offload.mb_last =3D devtype_data->rx_last; =20 - can_rx_offload_add_timestamp(dev, &priv->offload); + err =3D can_rx_offload_add_timestamp(dev, &priv->offload); + if (err) + goto exit_free; =20 if (transceiver) priv->can.bitrate_max =3D transceiver->attrs.max_link_rate; @@ -1137,7 +1139,7 @@ static int at91_can_probe(struct platform_device *pde= v) err =3D register_candev(dev); if (err) { dev_err(&pdev->dev, "registering netdev failed\n"); - goto exit_free; + goto exit_offload; } =20 dev_info(&pdev->dev, "device registered (reg_base=3D%p, irq=3D%d)\n", @@ -1145,6 +1147,8 @@ static int at91_can_probe(struct platform_device *pde= v) =20 return 0; =20 + exit_offload: + can_rx_offload_del(&priv->offload); exit_free: free_candev(dev); exit_iounmap: @@ -1165,6 +1169,8 @@ static void at91_can_remove(struct platform_device *p= dev) =20 unregister_netdev(dev); =20 + can_rx_offload_del(&priv->offload); + iounmap(priv->reg_base); =20 res =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); --=20 2.43.0 From nobody Fri Sep 25 23:54:04 2026 Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazon11013062.outbound.protection.outlook.com [52.101.83.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 093A735E953; Mon, 7 Sep 2026 10:50:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.83.62 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788778206; cv=fail; b=Va5jV1nn5+mraK243rPZV488ZhbEDuKz0mFr228Rl2c1gq3hQJNu/HtU1tfhrQMJlWZl8nnZqHCbS6axCUMF24r4zs8yqR4foUZ4W0VNcUsHDhLqc9Y7AoRW47Phxa3gJlKU9AaVw7IcodTtCpRr20LsYNqsJp3VoHqRuaYqh5A= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788778206; c=relaxed/simple; bh=bQ0YpCqCtS05GiO3Zsae6jxSI6dq6iFoH7aSjBEUtpI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=fYdvjaE+oVjTOzWFM0IVgeWyCkLF8DHadTxvqCn2D4U16xeg/1aMxB8Gx5VwBtKM5gSTmgICc+X2ybBYmDioYj6Z+vFsK06g6sXXVk8oTTruFA8DDGsakLkK15Gm4ZZihpETEua9nj5gPuOCeX+0sh9lwXkKLrkjgW1XSz9+5Ks= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.nxp.com; spf=pass smtp.mailfrom=oss.nxp.com; dkim=pass (2048-bit key) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b=upp/S3Rz; arc=fail smtp.client-ip=52.101.83.62 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.nxp.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.nxp.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b="upp/S3Rz" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PAd2fUE5O4UtfsjABD4Ki6IF93c5PzarprSUSzPM6qS+aBRQHMQSpm9UD+JaP9Q5L6uhHb24cSf9232C5C3nBkXT7OciNK27vAwmX4lCAtcM0jIIczW9eI+doeYhxz+Q6AFpz4Tyb+fXF6JgPHNx90rwpqigYz2asTwJDpHSLS02HEZC89Pn0hZMJLdaUTwAxhjO2beijffm1Nu0URPRe6ZcDn1AYW+UDrfVrmYr8AXpK4KiSMbasTioWgUrD9/iPSMAXJGI7bKcFw/d8BmCuH87vjtizPosWC/rb9VlOvNZEhfKvdoAlc4d2Z/WPh1lTm1FFxYDYo9HqdJ4HggGFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=q078mk27nv/IA37Knfv+c2HeolLnRl5HAWrW7WTYj0E=; b=s+vKh6CTpLmTfUpRo0r5l0jrip6DQhgHylbbW0X3rHNmIAGP5JDpD0H4cKhDNLyntQ9pS8u5VFNH/0eqmMQiX+wN95w2r+BPoqjXfWeUc+jggtRiTyEM5trcB+oKNcHuo+dSaqEPYA6Z2OCI7/Q8HhblBzi2EvyTpkqi7PQxcOzs+m0W1vM58Y8HEtdSRDfAuUoat6HOe0EEKlwYYcorggToIIcFy8krdCfzIG2dccju/Xp4IekS0y6ilYBkT02T+jydySaxqlZtm34jbc+8rWh4aG4z1OCixrW1h2mRpreQiGV00QCg9jZMjzhvUBvqrbVRZL8OdPyPulcARvIluw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oss.nxp.com; dmarc=pass action=none header.from=oss.nxp.com; dkim=pass header.d=oss.nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NXP1.onmicrosoft.com; s=selector1-NXP1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q078mk27nv/IA37Knfv+c2HeolLnRl5HAWrW7WTYj0E=; b=upp/S3RzKSbSmwcJC+uIj33/B8OfvpZjJWQViHvixYr6vo1M5+tDanQSHo18StQZZqejQMEv5sRzmWkqlUktbvAANrKJAU4Y7+91yRX3LrnGDSc7t5TaYjOZ6e2UdnmxyW3nehPw/MO0pDR+v8HdGyEllwRUoq8gTocFqVKmke4VQoHTtfMmnASffEyrW+Yq/vrbMB+ZNo57MK/ZGeqo3iOMhaCrCy3bCtWBhQjmydzf9R7dLam8WsMPYZK1Wn3Ot2svgwAMhhMj8+oMdDYVJ9aEKLlC35JHk6cCz3mCuJ5a3Jo1N1Pz4qxHSHnARkQVoNcUQ3LNeMurpaj/u0hNEg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=oss.nxp.com; Received: from AM0PR04MB5858.eurprd04.prod.outlook.com (2603:10a6:208:132::23) by DBBPR04MB7578.eurprd04.prod.outlook.com (2603:10a6:10:208::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 10:49:48 +0000 Received: from AM0PR04MB5858.eurprd04.prod.outlook.com ([fe80::bdf4:c9d1:4e3f:68c6]) by AM0PR04MB5858.eurprd04.prod.outlook.com ([fe80::bdf4:c9d1:4e3f:68c6%3]) with mapi id 15.21.0382.007; Mon, 7 Sep 2026 10:49:48 +0000 From: Ciprian Costea To: Marc Kleine-Budde , Vincent Mailhol , Nicolas Ferre , Alexandre Belloni , Claudiu Beznea , Kurt Van Dijck Cc: linux-can@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, NXP S32 Linux Team , Ciprian Marian Costea Subject: [PATCH v5 3/3] can: gs_usb: check can_rx_offload_add_manual() return value Date: Mon, 7 Sep 2026 12:49:42 +0200 Message-ID: <20260907104942.17089-4-ciprianmarian.costea@oss.nxp.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907104942.17089-1-ciprianmarian.costea@oss.nxp.com> References: <20260907104942.17089-1-ciprianmarian.costea@oss.nxp.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: FR0P281CA0138.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:96::7) To AM0PR04MB5858.eurprd04.prod.outlook.com (2603:10a6:208:132::23) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM0PR04MB5858:EE_|DBBPR04MB7578:EE_ X-MS-Office365-Filtering-Correlation-Id: 3c2a3220-5d42-4274-f624-08df0ccdbcba X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|19092799006|7416014|11063799006|56012099006|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: HmphdOtHGITeR4gASindsa1vJfuq3sVsse9lo/DEIbFGNwyWgADNDNa16tBmqnNr5iPs9QShyEfBEvTdtWHnMbApKwhZ3B+XlHrcA83TRwCbmt6mUXkQOqtqVpO/ZdmPqGJRfZvoIecLdxQDjl8PksZITuZnjkJid3BuxvAiFjxaSZ4KVy//xkfIjhM9qPO8Ztidt0V1Urf6S83F73NEUKP3fCDq47Bj736vyYHHh1xJkhjaPyQp861sHRSDCBraP9bB22Y69/HkiUzOnNADc/hMYdrGisskzSXEney4MEmR9K0o2EAm5fSxxw0ImJcC2hqtBHLHqeZ34ypmQ4IePx7xIxGNkWm9E3lGZ0KCfz0pULQDDPMyDDoCdfvg8ReaWJc5VZHNmqzfODa6Zefh0PMBowxxkMOCHMwRPjoAy9BixeIjFws2ARvDWM8Ervyjg115OjlAY1YxGWPNhcBzKcHtXhP0LWIEKjsLf6ihc8pyRREH0SmCY0u1qEHr+pcCyrMvS0j3c0DFCrnQ1eAwiuqciQJ8mNX8hUxVFWky7jXQbqWpWjsVlvObEXa0350SlA3/8MCUFJ0lMlFW1lG2pfsMViblBaDhcneirXhIz9H7m3v/+ajvyKCYOrrIxIFEfFVNesPtsIlJ+MLVWkOXyHjaSuS6RM0ESR/Z9iqXlK0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM0PR04MB5858.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(19092799006)(7416014)(11063799006)(56012099006)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cmpKN09rNG1CT3VEcXYrTU1kV0pTVElhUnRGbHpFUXdTaWFlNE5LZmVndHJK?= =?utf-8?B?MXZ1MEpvY09KRlFVK1h3Rml3MlBMZElKS2ZwNUdFZFNrd1U2Zm90aEdnRFRt?= =?utf-8?B?TWYyY1RZdTNPQ1hRVUpIaXZXZkFKOVQvRW5BeXVTQms0SnpRRWtzNkc3anBs?= =?utf-8?B?M2V5WnpJWnVPVnMvMENNZ056MTA5ZU5QTVgxbGpsK3BDRlV0NmRMckFOOGxZ?= =?utf-8?B?LzBtS2Y4UmYyekJNVnh5c24rQWo0K1RXMmpVYzlDNWlNdkNkdHpCVUdweG04?= =?utf-8?B?elp6MmZiMUowNE9pUGMyVW8wd3hmWjBxRC9od2FwbG83U2djQXIwR3FLWUcy?= =?utf-8?B?bzdNRSs4Q3I3My85dWV2eXlPZ2psNGt5UENjcmNKbDhZNWZnY1VCYldDbFpB?= =?utf-8?B?dFllU0ZhZWRlTlVXckw1V0xkTXlVTjgySFRVZUFDYjRpeUhWZ1owYjU4Qlcy?= =?utf-8?B?QzZZWHdETmJXRmJEdkJ2QkRmaXJvWnNMR3Q2RXlsM3BBa1QwWDF0Y253VWkr?= =?utf-8?B?SjFNcW0xWUlsTEdGdWk0a2d3TnlmdDF3ZWhiWFVic0NpR3FCWkZmR1gyQ3ZR?= =?utf-8?B?U3lrbEQzV1JFUHFSVm9JTDhibEdFTWhPWUR5WHpmSERVMnFCU25wdXVRalNK?= =?utf-8?B?UEMyUGkxK0s3TSs4SWtmTTNnUDRiNWVETmRwSVUwNldqWjR0VEpuZnhiTk9q?= =?utf-8?B?dTFiSW1YcWxjZS85cGJLZ1FhVmZKaFBJUmVWQzBhRTJlcDh2TUpIcEZCVDNQ?= =?utf-8?B?all2YURZcnl0VCszaGNHd2gyVW1Nc3ZwcHBQN292RWMyb3padFVPcDFSQ3ht?= =?utf-8?B?b1pVUEtkWlZubG1KM2tUSTYzYWE2bEI4SWx1cktyd0duTDB6K29rUkw3eHJT?= =?utf-8?B?TmxMRW9xNEFGWS83aDRoWFlWYWlMTXI2emE2Q3NsRHE0aTZqMDkyMElqTXZl?= =?utf-8?B?RlhLUDlHenNSRlJwU1JuOU1aQTFEMHR6VklXL3RvR2twaEtHUFdsb3NJeWFL?= =?utf-8?B?Ri9pY2cyK2dxUDdWM0h3ajhhK3ozZzhiL283cm84c3RrMnpyb0hkZlM0Y1Jl?= =?utf-8?B?N1Ftd3hSdnNHZmNjTWJDa3k4Q1Zzd2xLWHlrTFpLYmhRWFhjUEdrUHZMMVpM?= =?utf-8?B?UDlXa1dHZDZqbEc4RDArVFZJVVFhcmU0MTZha3JyMkgwNU8vWXBoZzlNVHVS?= =?utf-8?B?MzdiSk92TmF6eTVWenNlbUJTQzI3WE5WRklnc2UzcmFmaHQwZDFkREhIVHlo?= =?utf-8?B?aWYzcWlBeHZISjI0czhidk5haDZKZ3pQVzFhVHM3andWQ0w3S015Z2I5Z0M5?= =?utf-8?B?aS9IWXRjWHJwU1RyQ2FiL0p6NDdacHJkaTlvamFONExrZ3JSZnNnRkRRRkRn?= =?utf-8?B?Q2xKWER5Vkl4b2QwM1pQZzVNNnhqQlRjNUpRNU5VWW9oZ3Z3ODBPSUpVMEJv?= =?utf-8?B?Zkc4MXc5L3g4aENZZHVOUjhhMytLNGxVbkNvbGs0MXNlUjJSa0Eyd2t2RnhY?= =?utf-8?B?Qk9OWjExczBFc3Z1QkY2b1lnMjdza0s5SHhuSUllUS8zMkR1NXk4a0J4RGYz?= =?utf-8?B?VEtZT2VCS3dyeEJiRWk5c3g4cDRxa0lrUTlyOUNNekljT2pOcktIbVlrYXdZ?= =?utf-8?B?NElPSnZzOGZGSHQ4SVBBNTluOEdLM21uVUFKU0VRR2EreDZHQlhCUFR6MGJm?= =?utf-8?B?ZUQxcWo2QTlFcmJ2UktEVFBtcUdqUVRxYWk4WmdXQWwxc2doayttZnVjWGRG?= =?utf-8?B?T2Q5aDFUa1VRKzNGL2Q2UnluVkVZNCtLRExFUHNobkRBMSt6My9HcUFPTzN3?= =?utf-8?B?ZmJpWW8rS2pjNmZqVHJNeUpGd1VZN3VXSnR5OW1uMTdHdkFvaEdQOHgxS0t5?= =?utf-8?B?YUtSSitxc3ZyTEJMSVhSalBzU1VrRkVUM1ZXczNQVGE1eFc1cmpjOUs3dEhu?= =?utf-8?B?RDZubTRsM2xMNXQrVUdxY3EwVTVkYlV0ODZvRGRvN0NpeUwyUlF1Y0NqQWI5?= =?utf-8?B?ZXZDUjA5cU9LWnRyV0hZd2EzL3c0U0hZc0VZVjVzUHh3VXQzalVJeEkrWElB?= =?utf-8?B?V3JOYmhMU1BaU2w3Y2o3UE1Yb2hUMWFvUmRjWGdVYjZXalJzL3hmM1M2dGRt?= =?utf-8?B?MEVNWmE0dFRpMnJSeUhOcWRJU1ZDbVY5S2ZvTitpRFFwYXFFeFJPT2diaUxG?= =?utf-8?B?QWxVWmYxc3ZMallWalo3NzgrZEYwWGZVZ1dsRXRleEFDcHM5Y1J4WjVjOTJO?= =?utf-8?B?NzRyZFNLcGVONmtiREpGdFFDTXIyOHpUU1ZVZzJFNEN0QlZTYjN4SDdzUGJk?= =?utf-8?B?cW9BMVYrZ2JjZ2s1TEFIOWxTSi9pZlFWZ1JQdzZUV1daZnJRYmdwRy9PRlp1?= =?utf-8?Q?LFk9xY4ZUPAhLmgM=3D?= X-OriginatorOrg: oss.nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3c2a3220-5d42-4274-f624-08df0ccdbcba X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB5858.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 10:49:48.5233 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /6OQowA/vzFPJ1ec3fV+yAOXn7PbJzrIoktLmd1q3IMjE0yDh7ZTTi1I5mS8Foakm2Kia7pwlgxuShj72Iey5chtjBgcLNkruLYcDv3BRA4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DBBPR04MB7578 Content-Type: text/plain; charset="utf-8" From: Ciprian Marian Costea gs_make_candev() ignores the return value of can_rx_offload_add_manual(). Once can_rx_offload's skb_irq_queue is made per-CPU, that call allocates a per-CPU queue and can fail with -ENOMEM, leaving offload->skb_irq_queue =3D= =3D NULL. Check the return value and exit via the existing free_candev() on error path. Fixes: 24bc41b45583 ("can: gs_usb: convert to NAPI/rx-offload to avoid OoO = reception") Signed-off-by: Ciprian Marian Costea --- drivers/net/can/usb/gs_usb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index 3b9b2f104d86..cac4ce323a1d 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -1487,7 +1487,10 @@ static struct gs_can *gs_make_candev(unsigned int ch= annel, dev->can.fd.data_bittiming_const =3D &dev->data_bt_const; } =20 - can_rx_offload_add_manual(netdev, &dev->offload, GS_NAPI_WEIGHT); + rc =3D can_rx_offload_add_manual(netdev, &dev->offload, GS_NAPI_WEIGHT); + if (rc) + goto out_free_candev; + SET_NETDEV_DEV(netdev, &intf->dev); =20 rc =3D register_candev(dev->netdev); --=20 2.43.0