From: Sabrina Dubroca <sd@queasysnail.net>
To: Oliver Hartkopp <socketcan@hartkopp.net>
Cc: linux-can@vger.kernel.org, netdev@vger.kernel.org,
syzbot+c3ea30e1e2485573f953@syzkaller.appspotmail.com,
dvyukov@google.com, mkl@pengutronix.de, j.vosburgh@gmail.com,
vfalico@gmail.com, andy@greyhouse.net, davem@davemloft.net,
linux-stable <stable@vger.kernel.org>
Subject: Re: [PATCH] bonding: do not enslave CAN devices
Date: Thu, 30 Jan 2020 14:41:41 +0100 [thread overview]
Message-ID: <20200130134141.GA804563@bistromath.localdomain> (raw)
In-Reply-To: <20200130133046.2047-1-socketcan@hartkopp.net>
Hello,
2020-01-30, 14:30:46 +0100, Oliver Hartkopp wrote:
> Since commit 8df9ffb888c ("can: make use of preallocated can_ml_priv for per
> device struct can_dev_rcv_lists") the device specific CAN receive filter lists
> are stored in netdev_priv() and dev->ml_priv points to these filters.
>
> In the bug report Syzkaller enslaved a vxcan1 CAN device and accessed the
> bonding device with a PF_CAN socket which lead to a crash due to an access of
> an unhandled bond_dev->ml_priv pointer.
>
> Deny to enslave CAN devices by the bonding driver as the resulting bond_dev
> pretends to be a CAN device by copying dev->type without really being one.
Does the team driver have the same problem?
--
Sabrina
next prev parent reply other threads:[~2020-01-30 13:41 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-30 13:30 [PATCH] bonding: do not enslave CAN devices Oliver Hartkopp
2020-01-30 13:41 ` Sabrina Dubroca [this message]
2020-01-30 13:57 ` Oliver Hartkopp
2020-02-04 17:11 ` Oliver Hartkopp
2020-02-25 20:32 ` Marc Kleine-Budde
2020-02-27 4:23 ` David Miller
2020-03-02 8:45 ` Oliver Hartkopp
2020-03-02 19:12 ` David Miller
2020-03-06 14:12 ` Marc Kleine-Budde
2020-03-06 17:34 ` Dmitry Vyukov
2020-03-07 5:13 ` David Miller
2020-03-09 10:25 ` Marc Kleine-Budde
2020-03-13 9:56 ` Oleksij Rempel
2020-03-21 14:00 ` Oliver Hartkopp
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200130134141.GA804563@bistromath.localdomain \
--to=sd@queasysnail.net \
--cc=andy@greyhouse.net \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=j.vosburgh@gmail.com \
--cc=linux-can@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=socketcan@hartkopp.net \
--cc=stable@vger.kernel.org \
--cc=syzbot+c3ea30e1e2485573f953@syzkaller.appspotmail.com \
--cc=vfalico@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox