CVE-2026-72121: can: bcm: add locking when updating filter and timer values

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add locking when updating filter and timer values

KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup() when updating timer and filter content while bcmrxhandler(), bcmrxtimeouthandler() or bcmrxthrhandler() run concurrently on incoming CAN traffic.

Protect the timer (ival1/ival2/ktival1/ktival2/ktlastmsg) and filter (nframes/flags/frames/lastframes) updates in bcmrxsetup() with a new per-op bcmrxupdatelock, taken with the matching scope in the RX handlers. memcpyfrommsg() is staged into a temporary buffer before the lock is taken, since it can sleep and must not run under a spinlock.

hrtimercancel() is always called without bcmrxupdatelock held, since bcmrxtimeouthandler()/bcmrxthrhandler() take the same lock and a running callback would otherwise deadlock against the canceller.

Also close a related race: bcmrxsetup() cleared the RTR flag in the stored reply frame's canid as a separate, unprotected step after the frame content was already installed, so a concurrent bcmrxhandler() could transmit a stale reply with CANRTRFLAG still set. Fold that normalization into the initial frame preparation instead (on the staged buffer for updates, directly on op->frames pre-registration for new ops), so the installed frame is always atomically self-consistent.

bcmrxhandler()'s RXRTRFRAME check now takes a lock-protected snapshot of op->flags before deciding whether to call bcmcantx(), but does not hold the lock across that call.

Also take a lock-protected snapshot of the currframe in bcmcantx() to avoid partly overwrites by content updates in bcmtxsetup(). Finally check if a TXRESETMULTIIDX/SETTIMER might have reset op->currframe between the two locked sections in bcmcantx().

Omit calling hrtimerforward() with zero interval in bcmrxthrhandler(). ktival2 may have been concurrently cleared by bcmrxsetup() before it cancels this timer, so check ktival2 inside the bcmrxupdatelock.