]> git.baikalelectronics.ru Git - kernel.git/commit
net: introduce CAN specific pointer in the struct net_device
authorOleksij Rempel <o.rempel@pengutronix.de>
Tue, 23 Feb 2021 07:01:26 +0000 (08:01 +0100)
committerJakub Kicinski <kuba@kernel.org>
Wed, 24 Feb 2021 22:32:15 +0000 (14:32 -0800)
commit82817a0154953b7b24a8ed7b9ca7f79186102b04
tree1340eb5e6266f2a29d1afe078cce883837e6a02f
parentc794be6161389873cccc7dbdb58e913bd38613a2
net: introduce CAN specific pointer in the struct net_device

Since dda0bb882334 ("can: Speed up CAN frame receiption by using
ml_priv") the CAN framework uses per device specific data in the AF_CAN
protocol. For this purpose the struct net_device->ml_priv is used. Later
the ml_priv usage in CAN was extended for other users, one of them being
CAN_J1939.

Later in the kernel ml_priv was converted to an union, used by other
drivers. E.g. the tun driver started storing it's stats pointer.

Since tun devices can claim to be a CAN device, CAN specific protocols
will wrongly interpret this pointer, which will cause system crashes.
Mostly this issue is visible in the CAN_J1939 stack.

To fix this issue, we request a dedicated CAN pointer within the
net_device struct.

Reported-by: syzbot+5138c4dd15a0401bec7b@syzkaller.appspotmail.com
Fixes: dda0bb882334 ("can: Speed up CAN frame receiption by using ml_priv")
Fixes: 4df62ce38c7e ("can: introduce CAN midlayer private and allocate it automatically")
Fixes: 877b9bba3266 ("can: add support of SAE J1939 protocol")
Fixes: 5c0f20af6c4f ("tun: switch to net core provided statistics counters")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20210223070127.4538-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/can/dev/dev.c
drivers/net/can/slcan.c
drivers/net/can/vcan.c
drivers/net/can/vxcan.c
include/linux/can/can-ml.h
include/linux/netdevice.h
net/can/af_can.c
net/can/j1939/main.c
net/can/j1939/socket.c
net/can/proc.c