[PATCH v3 0/2] can: rx-offload: make skb_irq_queue per-CPU
From: Ciprian Costea
Date: Tue Sep 01 2026 - 06:41:19 EST
From: Ciprian Marian Costea <ciprianmarian.costea@xxxxxxxxxxx>
can_rx_offload keeps a lockless irq_queue that the IRQ handlers fill and
that is later spliced under skb_queue.lock into the NAPI-facing skb_queue.
This works as long as a single context fills the irq_queue. flexcan with
FLEXCAN_QUIRK_SECONDARY_MB_IRQ and mcf5441x use two mailbox IRQ lines. When
those are affined to different CPUs the two handlers can enqueue into the
same list at the same time and corrupt it.
This series:
1. Makes the irq_queue per-CPU so the handlers no longer share a list.
2. Fixes at91_can rx-offload teardown.
Changes since v2:
- at91_can: also add can_rx_offload_del() on the register_candev() error
path and check the can_rx_offload_add_timestamp() return value.
Changes since v1:
- The enqueue helpers used this_cpu_ptr() without disabling preemption.
All four enqueue helpers now use get_cpu_ptr()/put_cpu_ptr().
- Guard can_rx_offload_del() against skb_irq_queue == NULL.
- Fix 'at91_can' memory leak by adding missing 'can_rx_offload_del'.
Ciprian Marian Costea (2):
can: rx-offload: make skb_irq_queue per-CPU
can: at91_can: fix rx-offload cleanup on unbind and probe errors
drivers/net/can/at91_can.c | 10 +++-
drivers/net/can/dev/rx-offload.c | 83 ++++++++++++++++++++++++++------
include/linux/can/rx-offload.h | 2 +-
3 files changed, 78 insertions(+), 17 deletions(-)
--
2.43.0