[PATCH] can: rx-offload: make skb_irq_queue per-CPU
From: Ciprian Costea
Date: Mon Aug 31 2026 - 15:49:49 EST
From: Ciprian Marian Costea <ciprianmarian.costea@xxxxxxxxxxx>
skb_irq_queue is filled by the IRQ handlers using the lockless
__skb_queue_add_sort() / __skb_queue_tail() helpers and later spliced
into skb_queue under skb_queue.lock by can_rx_offload_irq_finish() and
can_rx_offload_threaded_irq_finish().
This is only safe while a single context fills skb_irq_queue. FlexCAN
on NXP S32G2 (FLEXCAN_QUIRK_SECONDARY_MB_IRQ) uses two mailbox IRQ
lines, one for MB0-7 and one for MB8-63; MCF5441X similarly splits its
mailbox interrupt. When these lines are affined to different CPUs both
handlers can run at the same time and enqueue into the same sk_buff_head
concurrently, corrupting its list.
Allocate skb_irq_queue per-CPU and enqueue via this_cpu_ptr() so the
handlers no longer share a list, keeping the enqueue path lock-free.
can_rx_offload_irq_finish() runs in the same context as its enqueues and
splices this_cpu_ptr(). can_rx_offload_threaded_irq_finish() may be
migrated, so it splices every possible CPU's queue.
Cross-line frames are now sorted by timestamp only within a CPU's queue
and appended across CPUs on splice; each skb keeps its own timestamp.
Fixes: c757096ea103 ("can: rx-offload: add skb queue for use during ISR")
Signed-off-by: Ciprian Marian Costea <ciprianmarian.costea@xxxxxxxxxxx>
---
drivers/net/can/dev/rx-offload.c | 51 ++++++++++++++++++++++++--------
include/linux/can/rx-offload.h | 2 +-
2 files changed, 40 insertions(+), 13 deletions(-)
diff --git a/drivers/net/can/dev/rx-offload.c b/drivers/net/can/dev/rx-offload.c
index 46e7b6db4a1e..48d814664b3d 100644
--- a/drivers/net/can/dev/rx-offload.c
+++ b/drivers/net/can/dev/rx-offload.c
@@ -7,6 +7,7 @@
#include <linux/can/dev.h>
#include <linux/can/rx-offload.h>
+#include <linux/percpu.h>
struct can_rx_offload_cb {
u32 timestamp;
@@ -175,6 +176,7 @@ can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload,
u64 pending)
{
+ struct sk_buff_head *irq_queue = this_cpu_ptr(offload->skb_irq_queue);
unsigned int i;
int received = 0;
@@ -190,7 +192,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload,
if (IS_ERR_OR_NULL(skb))
continue;
- __skb_queue_add_sort(&offload->skb_irq_queue, skb,
+ __skb_queue_add_sort(irq_queue, skb,
can_rx_offload_compare);
received++;
}
@@ -201,6 +203,7 @@ EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_timestamp);
int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
{
+ struct sk_buff_head *irq_queue = this_cpu_ptr(offload->skb_irq_queue);
struct sk_buff *skb;
int received = 0;
@@ -211,7 +214,7 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
if (!skb)
break;
- __skb_queue_tail(&offload->skb_irq_queue, skb);
+ __skb_queue_tail(irq_queue, skb);
received++;
}
@@ -222,6 +225,7 @@ EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo);
int can_rx_offload_queue_timestamp(struct can_rx_offload *offload,
struct sk_buff *skb, u32 timestamp)
{
+ struct sk_buff_head *irq_queue = this_cpu_ptr(offload->skb_irq_queue);
struct can_rx_offload_cb *cb;
if (skb_queue_len(&offload->skb_queue) >
@@ -233,7 +237,7 @@ int can_rx_offload_queue_timestamp(struct can_rx_offload *offload,
cb = can_rx_offload_get_cb(skb);
cb->timestamp = timestamp;
- __skb_queue_add_sort(&offload->skb_irq_queue, skb,
+ __skb_queue_add_sort(irq_queue, skb,
can_rx_offload_compare);
return 0;
@@ -268,13 +272,15 @@ EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb_queue_timestamp);
int can_rx_offload_queue_tail(struct can_rx_offload *offload,
struct sk_buff *skb)
{
+ struct sk_buff_head *irq_queue = this_cpu_ptr(offload->skb_irq_queue);
+
if (skb_queue_len(&offload->skb_queue) >
offload->skb_queue_len_max) {
dev_kfree_skb_any(skb);
return -ENOBUFS;
}
- __skb_queue_tail(&offload->skb_irq_queue, skb);
+ __skb_queue_tail(irq_queue, skb);
return 0;
}
@@ -307,14 +313,15 @@ EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb_queue_tail);
void can_rx_offload_irq_finish(struct can_rx_offload *offload)
{
+ struct sk_buff_head *irq_queue = this_cpu_ptr(offload->skb_irq_queue);
unsigned long flags;
int queue_len;
- if (skb_queue_empty_lockless(&offload->skb_irq_queue))
+ if (skb_queue_empty_lockless(irq_queue))
return;
spin_lock_irqsave(&offload->skb_queue.lock, flags);
- skb_queue_splice_tail_init(&offload->skb_irq_queue, &offload->skb_queue);
+ skb_queue_splice_tail_init(irq_queue, &offload->skb_queue);
spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
queue_len = skb_queue_len(&offload->skb_queue);
@@ -330,15 +337,21 @@ void can_rx_offload_threaded_irq_finish(struct can_rx_offload *offload)
{
unsigned long flags;
int queue_len;
-
- if (skb_queue_empty_lockless(&offload->skb_irq_queue))
- return;
+ int cpu;
spin_lock_irqsave(&offload->skb_queue.lock, flags);
- skb_queue_splice_tail_init(&offload->skb_irq_queue, &offload->skb_queue);
+ for_each_possible_cpu(cpu) {
+ struct sk_buff_head *irq_queue;
+
+ irq_queue = per_cpu_ptr(offload->skb_irq_queue, cpu);
+ skb_queue_splice_tail_init(irq_queue, &offload->skb_queue);
+ }
spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
queue_len = skb_queue_len(&offload->skb_queue);
+ if (!queue_len)
+ return;
+
if (queue_len > offload->skb_queue_len_max / 8)
netdev_dbg(offload->dev, "%s: queue_len=%d\n",
__func__, queue_len);
@@ -353,13 +366,21 @@ static int can_rx_offload_init_queue(struct net_device *dev,
struct can_rx_offload *offload,
unsigned int weight)
{
+ int cpu;
+
offload->dev = dev;
/* Limit queue len to 4x the weight (rounded to next power of two) */
offload->skb_queue_len_max = 2 << fls(weight);
offload->skb_queue_len_max *= 4;
skb_queue_head_init(&offload->skb_queue);
- __skb_queue_head_init(&offload->skb_irq_queue);
+
+ offload->skb_irq_queue = alloc_percpu(struct sk_buff_head);
+ if (!offload->skb_irq_queue)
+ return -ENOMEM;
+
+ for_each_possible_cpu(cpu)
+ __skb_queue_head_init(per_cpu_ptr(offload->skb_irq_queue, cpu));
netif_napi_add_weight(dev, &offload->napi, can_rx_offload_napi_poll,
weight);
@@ -420,8 +441,14 @@ EXPORT_SYMBOL_GPL(can_rx_offload_enable);
void can_rx_offload_del(struct can_rx_offload *offload)
{
+ int cpu;
+
netif_napi_del(&offload->napi);
skb_queue_purge(&offload->skb_queue);
- __skb_queue_purge(&offload->skb_irq_queue);
+
+ for_each_possible_cpu(cpu)
+ __skb_queue_purge(per_cpu_ptr(offload->skb_irq_queue, cpu));
+
+ free_percpu(offload->skb_irq_queue);
}
EXPORT_SYMBOL_GPL(can_rx_offload_del);
diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h
index d29bb4521947..1b9e2a8ab39a 100644
--- a/include/linux/can/rx-offload.h
+++ b/include/linux/can/rx-offload.h
@@ -20,7 +20,7 @@ struct can_rx_offload {
bool drop);
struct sk_buff_head skb_queue;
- struct sk_buff_head skb_irq_queue;
+ struct sk_buff_head __percpu *skb_irq_queue;
u32 skb_queue_len_max;
unsigned int mb_first;
--
2.43.0