From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=pass header.oldest-pass=0 smtp.remote-ip=185.203.200.13 ARC-Seal: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=pass; t=1792624304; b=lXYig9viNu9KdPk/dTJDht42N179au4hw3/zGDWSqLLUdHENkcoHJx2DIRwhhNWUjqMs LC437Khz3ChmvxJefw9mHj7Wbh8TTgGjl/KUHFYorKv4pQYjXkrkY6F7UJcWAMsN7jB1q l2Q32EDn9CZ0JJQRexcqA3QmJ+a2UwB09YdJF/DkN+GSFTwvTViQgy417QSE6LDcOhmqb QzH1uuvLrlfGuFc9RODVgvJ6x6ZOKSR+X796F++VYkzqwtA0S2r5xEvNt9bNty22b/vIh lQKf3aDC6lf3RxTBBg8Bd/QZssgC/RYwYSkr2PgUW04QyyAABq3df2r15ZYKmb3yyGw== ARC-Message-Signature: i=2; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792624304; h=DMARC-Filter:Received:DKIM-Signature:Received:Received:From:To:Cc: Subject:Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=XdBhLp9U2Mj8PEuO2cOs+aEIvq+M8XSNSkodp9Z9Bpw=; b=NLCdNv7EprkXo6l09RM2f9NeS9Xt427mBlbMPUuurAby3SDxV3JSaumo2m0hTfuJfv58 CpkaZf7XHO9Sb4uzk7LWx2Y46tPstU4RjtU2ZsLKdPBpnV0ql2EfHXoDzrjSD7fR4S4wN pwKJ/94Is5Yhf4bILv9kGv0caoNuqUn+eQyJb/xx2dSugg1d6APuXORNfL8cQCpqk53xq 7XRLoHBy9bUusADGdOZXghUTg10h8ToR8Ww9I4/KC0MomC4nRYg7EaA0DO75RCnO4Pq+i cWG8VY3IT69SbhMuMd2TsmHoaWf8E4kRIjwETWGu25jlYb2cdU5dWLfeppsITQp8J6A== ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none header.from=pengutronix.de; spf=pass smtp.mailfrom=pengutronix.de; dkim=pass header.d=pengutronix.de header.i=@pengutronix.de header.a=rsa-sha256 header.s=20260414 header.b=d52Kuu2F; arc=pass header.oldest-pass=0 smtp.remote-ip=185.203.200.13 Received: from mx1.white.stw.pengutronix.de (mx1.white.stw.pengutronix.de [185.203.200.13]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2EB8606A327; Wed, 21 Oct 2026 23:11:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org E2EB8606A327 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=pengutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=pengutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=pengutronix.de header.i=@pengutronix.de header.a=rsa-sha256 header.s=20260414 header.b=d52Kuu2F Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 5AECB201E29; Thu, 22 Oct 2026 01:11:38 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1792624298; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XdBhLp9U2Mj8PEuO2cOs+aEIvq+M8XSNSkodp9Z9Bpw=; b=d52Kuu2F792iOxDLOj1kZEvYK763jWw4VndPgf8rSwm1QPzGlF0FCUIh52FG7tJZRY9SJr qvHswKvt9CdK7Klst6+JDJ+0i0xeUyR+nrJrAq/RlUFbXm6GX1ZVtlz2uL8oqEzOzmgfBP ddbvJ7l/BYUgdMn0WOweGn2Acb+hItLe1ZBpfnONtsUpj52a+zSJmJ2ZasmtKLpUdfw0fA 1rq+3qswO3sQ7TQr+Am3+t5/05k866RXkDLVLhidxwTwNzFq1fCdPxHXGlJw+mAdM3MKSY nuCITUkLtC1kHflw5K81yUxoN9w9gTOF0TAMNYux6EVZQp7exK8dOQ1VSIKSmA== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1792624298; a=rsa-sha256; cv=none; b=hAbp4IJh/JapQyTpg/Hai2WP/sNCp8eEEVEHopVBkf/ufXJrjyVjkjuLd8lZLzg++SSwPq gtDh0+jKzT4bWtIqctBdgCg7NP8qBxKKf/l1gmyILPLJExIzYLMdUcgaojoiv6jED1obXH 90oz4egQYjfnnX1oTHCm64KAMz1yO41gBqw01X98RQiPSV7gCYqHbYdqkn0VKac0e6mtsD QqmkfJp1XOSjV/UgzW2OizbDCt+PvEWaNf0/pDwiNyeYgeJNlXXd9PqD79GDDYXJiOM+tA qysQ/xgAtpgwqtcaDI7zOtmrWCxxiYSX+9ybRn+202LnmGBKzD/CwIHL+xnXaA== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-drehscheibe.grey.stw.pengutronix.de smtp.mailfrom=mkl@pengutronix.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1792624298; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XdBhLp9U2Mj8PEuO2cOs+aEIvq+M8XSNSkodp9Z9Bpw=; b=W5w51lMc9Tu/7s1RM+P9KOvJd+vJzvnjZUtMC2v8KQm0YTldk0/5fGoWaeud9L4YASFoe7 hFwQoQu3ASPqTwaOb+MVX6QXjPf/dXNZUsUIX9DcFJjozBG1Qp4gOojxwJ8nktP9044fK/ jXbqlNQB/Lj8Zl+i0kR4Thf2Zape2xJc2m7pLXNlsfthCl99JZUqc0s2VNHzJedPJKx6GY cqJTzcRfgg616n+SDImt9j+TCvZNw6UDWymTwslr31NsrlqaojeTIfOT7IlmOxkMh4KSt+ 1PAOujG4hE2rCtptMm8+7wC8vzLFlnbsmmVyp353DYvwRla6SFEcP4QpiJQA6g== Received: from moin.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::7b] helo=bjornoya.blackshift.org) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xJfT8-000cWb-0s; Thu, 22 Oct 2026 01:11:38 +0200 Received: from blackshift.org (unknown [IPv6:2a03:2260:2009::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: mkl-all@blackshift.org) by smtp.blackshift.org (Postfix) with ESMTPSA id 9D5CF5D06DF; Wed, 21 Oct 2026 23:11:37 +0000 (UTC) From: Marc Kleine-Budde To: netdev@vger.kernel.org Cc: davem@davemloft.net, kuba@kernel.org, linux-can@vger.kernel.org, kernel@pengutronix.de, Oliver Hartkopp , stable@kernel.org, Oleksij Rempel , Marc Kleine-Budde Subject: [PATCH net-next 10/11] can: replace ARPHRD_CAN type checks with can_get_ml_priv() Date: Thu, 22 Oct 2026 01:07:57 +0200 Message-ID: <20261021231130.2085690-11-mkl@pengutronix.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261021231130.2085690-1-mkl@pengutronix.de> References: <20261021231130.2085690-1-mkl@pengutronix.de> X-Mailing-List: netdev@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Oliver Hartkopp Commit 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") introduced an explicit way to assign the midlayer private pointer (dev->ml_priv) to named users like ML_PRIV_CAN. A valid pointer returned by can_get_ml_priv() therefore identifies a real CAN device. The referenced commit only converted the j1939 and proc code to this check, while the other parts of the CAN subsystem still rely on dev->type == ARPHRD_CAN. The TUNSETLINK ioctl allows a down TUN/TAP device to set its hardware type to ARPHRD_CAN while dev->ml_priv remains NULL. Such a repurposed netdevice passes the ARPHRD_CAN checks. Commit 8aa59e355949 ("can: af_can: fix NULL pointer dereference in can_rx_register()") already made can_rx_register() reject such devices. But can_rx_unregister() still only checks dev->type and dereferences the NULL ml_priv when it walks the receive lists of the device. CAN_ISOTP reaches this path: isotp_bind() ignores the return values of can_rx_register() and binds the socket anyway. When the socket is released or the device is unregistered, isotp_release() and isotp_notify() remove the filters that have never been registered and trigger the NULL pointer dereference in can_rx_unregister(). This only requires owning a TUN/TAP device or CAP_NET_ADMIN in an unprivileged user namespace. Convert the remaining ARPHRD_CAN checks in af_can, bcm, gw, isotp and raw to can_get_ml_priv(). Fixes: 4e096a18867a ("net: introduce CAN specific pointer in the struct net_device") Cc: stable@kernel.org Cc: Oleksij Rempel Signed-off-by: Oliver Hartkopp Link: https://patch.msgid.link/20261012164802.94113-1-socketcan@hartkopp.net Link: https://patch.msgid.link/20261020203257.230955-5-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde --- net/can/af_can.c | 15 ++++++--------- net/can/bcm.c | 7 ++++--- net/can/gw.c | 7 ++++--- net/can/isotp.c | 5 +++-- net/can/raw.c | 4 ++-- 5 files changed, 19 insertions(+), 19 deletions(-) diff --git a/net/can/af_can.c b/net/can/af_can.c index 6ebe9d3689ac..d97f85fc3232 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -226,7 +226,7 @@ int can_send(struct sk_buff *skb, int loop) goto inval_skb; } - if (unlikely(skb->dev->type != ARPHRD_CAN)) { + if (unlikely(!can_get_ml_priv(skb->dev))) { err = -EPERM; goto inval_skb; } @@ -452,7 +452,7 @@ int can_rx_register(struct net *net, struct net_device *dev, canid_t can_id, /* insert new receiver (dev,canid,mask) -> (func,data) */ - if (dev && (dev->type != ARPHRD_CAN || !can_get_ml_priv(dev))) + if (dev && !can_get_ml_priv(dev)) return -ENODEV; if (dev && !net_eq(net, dev_net(dev))) @@ -519,7 +519,7 @@ void can_rx_unregister(struct net *net, struct net_device *dev, canid_t can_id, struct can_rcv_lists_stats *rcv_lists_stats = net->can.rcv_lists_stats; struct can_dev_rcv_lists *dev_rcv_lists; - if (dev && dev->type != ARPHRD_CAN) + if (dev && !can_get_ml_priv(dev)) return; if (dev && !net_eq(net, dev_net(dev))) @@ -684,8 +684,7 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, { struct can_skb_ext *csx = can_skb_ext_find(skb); - if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || - !csx || !can_is_can_skb(skb))) { + if (unlikely(!can_get_ml_priv(dev) || !csx || !can_is_can_skb(skb))) { pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n", dev->type, skb->len); @@ -710,8 +709,7 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, { struct can_skb_ext *csx = can_skb_ext_find(skb); - if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || - !csx || !can_is_canfd_skb(skb))) { + if (unlikely(!can_get_ml_priv(dev) || !csx || !can_is_canfd_skb(skb))) { pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n", dev->type, skb->len); @@ -736,8 +734,7 @@ static int canxl_rcv(struct sk_buff *skb, struct net_device *dev, { struct can_skb_ext *csx = can_skb_ext_find(skb); - if (unlikely(dev->type != ARPHRD_CAN || !can_get_ml_priv(dev) || - !csx || !can_is_canxl_skb(skb))) { + if (unlikely(!can_get_ml_priv(dev) || !csx || !can_is_canxl_skb(skb))) { pr_warn_once("PF_CAN: dropped non conform CAN XL skbuff: dev type %d, len %d\n", dev->type, skb->len); diff --git a/net/can/bcm.c b/net/can/bcm.c index 6c85a76477c3..6759662e024c 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -54,6 +54,7 @@ #include #include #include +#include #include #include #include @@ -1718,7 +1719,7 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) goto out_release; } - if (dev->type != ARPHRD_CAN) { + if (!can_get_ml_priv(dev)) { dev_put(dev); ret = -ENODEV; goto out_release; @@ -1866,7 +1867,7 @@ static int bcm_notifier(struct notifier_block *nb, unsigned long msg, { struct net_device *dev = netdev_notifier_info_to_dev(ptr); - if (dev->type != ARPHRD_CAN) + if (!can_get_ml_priv(dev)) return NOTIFY_DONE; if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) return NOTIFY_DONE; @@ -2023,7 +2024,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr_unsized *uaddr, int ret = -ENODEV; goto fail; } - if (dev->type != ARPHRD_CAN) { + if (!can_get_ml_priv(dev)) { dev_put(dev); ret = -ENODEV; goto fail; diff --git a/net/can/gw.c b/net/can/gw.c index 36f9aa0f7026..8a5327d8a00e 100644 --- a/net/can/gw.c +++ b/net/can/gw.c @@ -52,6 +52,7 @@ #include #include #include +#include #include #include #include @@ -612,7 +613,7 @@ static int cgw_notifier(struct notifier_block *nb, struct net_device *dev = netdev_notifier_info_to_dev(ptr); struct net *net = dev_net(dev); - if (dev->type != ARPHRD_CAN) + if (!can_get_ml_priv(dev)) return NOTIFY_DONE; if (msg == NETDEV_UNREGISTER) { @@ -1163,7 +1164,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, if (!gwj->src.dev) goto out; - if (gwj->src.dev->type != ARPHRD_CAN) + if (!can_get_ml_priv(gwj->src.dev)) goto out; gwj->dst.dev = __dev_get_by_index(net, gwj->ccgw.dst_idx); @@ -1171,7 +1172,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh, if (!gwj->dst.dev) goto out; - if (gwj->dst.dev->type != ARPHRD_CAN) + if (!can_get_ml_priv(gwj->dst.dev)) goto out; /* is sending the skb back to the incoming interface intended? */ diff --git a/net/can/isotp.c b/net/can/isotp.c index 64ff203a37f4..5e1c3971ebfc 100644 --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -65,6 +65,7 @@ #include #include #include +#include #include #include #include @@ -1618,7 +1619,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int l err = -ENODEV; goto out; } - if (dev->type != ARPHRD_CAN) { + if (!can_get_ml_priv(dev)) { err = -ENODEV; goto out_put_dev; } @@ -1905,7 +1906,7 @@ static int isotp_notifier(struct notifier_block *nb, unsigned long msg, { struct net_device *dev = netdev_notifier_info_to_dev(ptr); - if (dev->type != ARPHRD_CAN) + if (!can_get_ml_priv(dev)) return NOTIFY_DONE; if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) return NOTIFY_DONE; diff --git a/net/can/raw.c b/net/can/raw.c index 3e57f72a3afe..dfea48768b23 100644 --- a/net/can/raw.c +++ b/net/can/raw.c @@ -348,7 +348,7 @@ static int raw_notifier(struct notifier_block *nb, unsigned long msg, { struct net_device *dev = netdev_notifier_info_to_dev(ptr); - if (dev->type != ARPHRD_CAN) + if (!can_get_ml_priv(dev)) return NOTIFY_DONE; if (msg != NETDEV_UNREGISTER && msg != NETDEV_DOWN) return NOTIFY_DONE; @@ -491,7 +491,7 @@ static int raw_bind(struct socket *sock, struct sockaddr_unsized *uaddr, int len err = -ENODEV; goto out; } - if (dev->type != ARPHRD_CAN) { + if (!can_get_ml_priv(dev)) { err = -ENODEV; goto out_put_dev; } -- 2.53.0