CAN BCM timer UAF patch rejected as already fixed

A patch meant to close a use-after-free in the Linux kernel's CAN Broadcast Manager was rejected after the subsystem maintainer said the bug is already fixed in mainline.

Nguyen Le Thanh Tung described a race reachable from an unprivileged local user with an AF_CAN BCM socket, including inside a user and network namespace over a virtual CAN interface. Deleting a receive operation unregisters the handler and immediately cancels its high-resolution timer before freeing the operation via RCU. A handler already running on another CPU can pass a flag check set only by a plain store, re-arm the timer after that cancel, and leave the timer enqueued against memory that is freed once the grace period ends. The timer softirq then touches freed storage, which can crash the machine or expose adjacent kernel memory.

An earlier change had inserted synchronize_rcu() on the socket teardown path so in-flight handlers drain before the timer is cancelled and the object is freed. The RX_DELETE path did not get the same barrier. Oliver Hartkopp NAKed the follow-up patch, writing that the issue is already fixed.