Re: [PATCH can-next v2] can: replace ARPHRD_CAN type checks with can_get_ml_priv()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] can: isotp: silent bind() failure if can_rx_register() returns -ENOMEM
--

commit 95cbcd2505f7f236f0737cc7471505243facbfe5
Author: Oliver Hartkopp <socketcan@hartkopp.net>

can: replace ARPHRD_CAN type checks with can_get_ml_priv()

This commit replaces explicit ARPHRD_CAN hardware type checks with
can_get_ml_priv() to prevent NULL pointer dereferences when a TUN/TAP
device is repurposed to mimic a CAN device.

Link: https://patch.msgid.link/20261012164802.94113-1-socketcan@hartkopp.net

> diff --git a/net/can/isotp.c b/net/can/isotp.c
> index f5dc9d04bd686..6c28802c0605f 100644
> --- a/net/can/isotp.c
> +++ b/net/can/isotp.c
> @@ -1610,7 +1611,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int l
>  		err = -ENODEV;
>  		goto out;
>  	}
> -	if (dev->type != ARPHRD_CAN) {
> +	if (!can_get_ml_priv(dev)) {
>  		err = -ENODEV;
>  		goto out_put_dev;
>  	}

[Severity: Medium]
A few lines lower in isotp_bind(), the return values of can_rx_register()
are ignored:

	if (isotp_register_rxid(so))
		can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id),
				isotp_rcv, sk, "isotp", sk);

	/* no consecutive frame echo skb in flight */
	WRITE_ONCE(so->cfecho, 0);

	/* register for echo skb's */
	can_rx_register(net, dev, tx_id, SINGLE_MASK(tx_id),
			isotp_rcv_echo, sk, "isotpe", sk);

If can_rx_register() fails (for example, returning -ENOMEM due to a failed
kmem_cache_alloc()), bind() will succeed but the socket is not fully
registered to receive CAN frames. This leads to a silent failure where
user-space believes the socket is successfully bound, but no traffic will
ever be received.

Could this regression be prevented by checking the return values and
propagating the error appropriately, or cleaning up any partial
registrations?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016093525.327367-1-socketcan@hartkopp.net?part=1