[syzbot ci] Re: pull-request: can-next 2025-09-24

Archive-only list for syzbot
 help / color / mirror / Atom feed

* [syzbot ci] Re: pull-request: can-next 2025-09-24
       [not found] <20250924082104.595459-1-mkl@pengutronix.de>
@ 2025-09-24 12:40 ` syzbot ci
  2025-09-24 13:18   ` Oliver Hartkopp
  2025-09-24 14:35   ` [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu() Vincent Mailhol
  0 siblings, 2 replies; 9+ messages in thread
From: syzbot ci @ 2025-09-24 12:40 UTC (permalink / raw)
  To: biju.das.jz, davem, geert, kernel, kuba, linux-can, mailhol, mkl,
	netdev, socketcan, stefan.maetje, stephane.grosjean, zhao.xichao
  Cc: syzbot, syzkaller-bugs

syzbot ci has tested the following series

[v1] pull-request: can-next 2025-09-24
https://lore.kernel.org/all/20250924082104.595459-1-mkl@pengutronix.de
* [PATCH net-next 01/48] can: m_can: use us_to_ktime() where appropriate
* [PATCH net-next 02/48] MAINTAINERS: update Vincent Mailhol's email address
* [PATCH net-next 03/48] can: dev: sort includes by alphabetical order
* [PATCH net-next 04/48] can: peak: Modification of references to email accounts being deleted
* [PATCH net-next 05/48] can: rcar_canfd: Update bit rate constants for RZ/G3E and R-Car Gen4
* [PATCH net-next 06/48] can: rcar_canfd: Update RCANFD_CFG_* macros
* [PATCH net-next 07/48] can: rcar_canfd: Simplify nominal bit rate config
* [PATCH net-next 08/48] can: rcar_canfd: Simplify data bit rate config
* [PATCH net-next 09/48] can: rcar_can: Consistently use ndev for net_device pointers
* [PATCH net-next 10/48] can: rcar_can: Add helper variable dev to rcar_can_probe()
* [PATCH net-next 11/48] can: rcar_can: Convert to Runtime PM
* [PATCH net-next 12/48] can: rcar_can: Convert to BIT()
* [PATCH net-next 13/48] can: rcar_can: Convert to GENMASK()
* [PATCH net-next 14/48] can: rcar_can: CTLR bitfield conversion
* [PATCH net-next 15/48] can: rcar_can: TFCR bitfield conversion
* [PATCH net-next 16/48] can: rcar_can: BCR bitfield conversion
* [PATCH net-next 17/48] can: rcar_can: Mailbox bitfield conversion
* [PATCH net-next 18/48] can: rcar_can: Do not print alloc_candev() failures
* [PATCH net-next 19/48] can: rcar_can: Convert to %pe
* [PATCH net-next 20/48] can: esd_usb: Rework display of error messages
* [PATCH net-next 21/48] can: esd_usb: Avoid errors triggered from USB disconnect
* [PATCH net-next 22/48] can: raw: reorder struct uniqframe's members to optimise packing
* [PATCH net-next 23/48] can: raw: use bitfields to store flags in struct raw_sock
* [PATCH net-next 24/48] can: raw: reorder struct raw_sock's members to optimise packing
* [PATCH net-next 25/48] can: annotate mtu accesses with READ_ONCE()
* [PATCH net-next 26/48] can: dev: turn can_set_static_ctrlmode() into a non-inline function
* [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
* [PATCH net-next 28/48] can: enable CAN XL for virtual CAN devices by default
* [PATCH net-next 29/48] can: dev: move struct data_bittiming_params to linux/can/bittiming.h
* [PATCH net-next 30/48] can: dev: make can_get_relative_tdco() FD agnostic and move it to bittiming.h
* [PATCH net-next 31/48] can: netlink: document which symbols are FD specific
* [PATCH net-next 32/48] can: netlink: refactor can_validate_bittiming()
* [PATCH net-next 33/48] can: netlink: add can_validate_tdc()
* [PATCH net-next 34/48] can: netlink: add can_validate_databittiming()
* [PATCH net-next 35/48] can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL} flag reset logic
* [PATCH net-next 36/48] can: netlink: remove useless check in can_tdc_changelink()
* [PATCH net-next 37/48] can: netlink: make can_tdc_changelink() FD agnostic
* [PATCH net-next 38/48] can: netlink: add can_dtb_changelink()
* [PATCH net-next 39/48] can: netlink: add can_ctrlmode_changelink()
* [PATCH net-next 40/48] can: netlink: make can_tdc_get_size() FD agnostic
* [PATCH net-next 41/48] can: netlink: add can_data_bittiming_get_size()
* [PATCH net-next 42/48] can: netlink: add can_bittiming_fill_info()
* [PATCH net-next 43/48] can: netlink: add can_bittiming_const_fill_info()
* [PATCH net-next 44/48] can: netlink: add can_bitrate_const_fill_info()
* [PATCH net-next 45/48] can: netlink: make can_tdc_fill_info() FD agnostic
* [PATCH net-next 46/48] can: calc_bittiming: make can_calc_tdco() FD agnostic
* [PATCH net-next 47/48] can: dev: add can_get_ctrlmode_str()
* [PATCH net-next 48/48] can: netlink: add userland error messages

and found the following issue:
KASAN: slab-out-of-bounds Read in can_setup

Full report is available here:
https://ci.syzbot.org/series/7feff13b-7247-438c-9d92-b8e9fda977c7

***

KASAN: slab-out-of-bounds Read in can_setup

tree:      net-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next.git
base:      315f423be0d1ebe720d8fd4fa6bed68586b13d34
arch:      amd64
compiler:  Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
config:    https://ci.syzbot.org/builds/08331a39-4a31-4f96-a377-3125df2af883/config
C repro:   https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-bb9d2fdb1d79/c_repro
syz repro: https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-bb9d2fdb1d79/syz_repro

netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'.
==================================================================
BUG: KASAN: slab-out-of-bounds in can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]
BUG: KASAN: slab-out-of-bounds in can_setup+0x209/0x280 drivers/net/can/dev/dev.c:279
Read of size 4 at addr ffff888106a6ee74 by task syz.0.17/5999

CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xca/0x240 mm/kasan/report.c:482
 kasan_report+0x118/0x150 mm/kasan/report.c:595
 can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]
 can_setup+0x209/0x280 drivers/net/can/dev/dev.c:279
 alloc_netdev_mqs+0x795/0x11b0 net/core/dev.c:11949
 rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3633
 rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3815
 __rtnl_newlink net/core/rtnetlink.c:3942 [inline]
 rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4057
 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6946
 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:729
 ____sys_sendmsg+0x505/0x830 net/socket.c:2614
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
 __sys_sendmsg net/socket.c:2700 [inline]
 __do_sys_sendmsg net/socket.c:2705 [inline]
 __se_sys_sendmsg net/socket.c:2703 [inline]
 __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0b7658ec29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff71a7bdf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f0b767d5fa0 RCX: 00007f0b7658ec29
RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003
RBP: 00007f0b76611e41 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0b767d5fa0 R14: 00007f0b767d5fa0 R15: 0000000000000003
 </TASK>

Allocated by task 5999:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
 kasan_kmalloc include/linux/kasan.h:260 [inline]
 __do_kmalloc_node mm/slub.c:4376 [inline]
 __kvmalloc_node_noprof+0x30d/0x5f0 mm/slub.c:5067
 alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11893
 rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3633
 rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3815
 __rtnl_newlink net/core/rtnetlink.c:3942 [inline]
 rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4057
 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6946
 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:729
 ____sys_sendmsg+0x505/0x830 net/socket.c:2614
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
 __sys_sendmsg net/socket.c:2700 [inline]
 __do_sys_sendmsg net/socket.c:2705 [inline]
 __se_sys_sendmsg net/socket.c:2703 [inline]
 __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888106a6e000
 which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 244 bytes to the right of
 allocated 3456-byte region [ffff888106a6e000, ffff888106a6ed80)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106a68
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88810e6ebb41
flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 057ff00000000040 ffff88801a44b500 ffffea00043e4000 dead000000000002
raw: 0000000000000000 0000000080040004 00000000f5000000 ffff88810e6ebb41
head: 057ff00000000040 ffff88801a44b500 ffffea00043e4000 dead000000000002
head: 0000000000000000 0000000080040004 00000000f5000000 ffff88810e6ebb41
head: 057ff00000000003 ffffea00041a9a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5901, tgid 5901 (syz-executor), ts 69629116017, free_ts 69616324772
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
 prep_new_page mm/page_alloc.c:1859 [inline]
 get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
 alloc_slab_page mm/slub.c:2492 [inline]
 allocate_slab+0x8a/0x370 mm/slub.c:2660
 new_slab mm/slub.c:2714 [inline]
 ___slab_alloc+0xbeb/0x1420 mm/slub.c:3901
 __slab_alloc mm/slub.c:3992 [inline]
 __slab_alloc_node mm/slub.c:4067 [inline]
 slab_alloc_node mm/slub.c:4228 [inline]
 __do_kmalloc_node mm/slub.c:4375 [inline]
 __kvmalloc_node_noprof+0x429/0x5f0 mm/slub.c:5067
 alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11893
 vti6_init_net+0x104/0x370 net/ipv6/ip6_vti.c:1146
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:136
 setup_net+0x10c/0x320 net/core/net_namespace.c:438
 copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570
 create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x11c/0x170 kernel/nsproxy.c:218
 ksys_unshare+0x4c8/0x8c0 kernel/fork.c:3127
 __do_sys_unshare kernel/fork.c:3198 [inline]
 __se_sys_unshare kernel/fork.c:3196 [inline]
 __x64_sys_unshare+0x38/0x50 kernel/fork.c:3196
page last free pid 5901 tgid 5901 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
 __slab_free+0x303/0x3c0 mm/slub.c:4606
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:340
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4191 [inline]
 slab_alloc_node mm/slub.c:4240 [inline]
 __kmalloc_cache_noprof+0x1be/0x3d0 mm/slub.c:4402
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 ref_tracker_alloc+0x133/0x460 lib/ref_tracker.c:271
 __netdev_tracker_alloc include/linux/netdevice.h:4379 [inline]
 netdev_hold include/linux/netdevice.h:4408 [inline]
 netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
 netdev_queue_update_kobjects+0x1d1/0x6c0 net/core/net-sysfs.c:2056
 register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
 netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
 register_netdevice+0x126c/0x1ae0 net/core/dev.c:11287
 __ip_tunnel_create+0x3e7/0x560 net/ipv4/ip_tunnel.c:268
 ip_tunnel_init_net+0x2ba/0x800 net/ipv4/ip_tunnel.c:1161
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:136
 setup_net+0x10c/0x320 net/core/net_namespace.c:438
 copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570
 create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110

Memory state around the buggy address:
 ffff888106a6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888106a6ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888106a6ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                             ^
 ffff888106a6ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888106a6ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


***

If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
  Tested-by: syzbot@syzkaller.appspotmail.com

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot ci] Re: pull-request: can-next 2025-09-24
  2025-09-24 12:40 ` [syzbot ci] Re: pull-request: can-next 2025-09-24 syzbot ci
@ 2025-09-24 13:18   ` Oliver Hartkopp
  2025-09-24 13:31     ` Vincent Mailhol
  2025-09-24 14:35   ` [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu() Vincent Mailhol
  1 sibling, 1 reply; 9+ messages in thread
From: Oliver Hartkopp @ 2025-09-24 13:18 UTC (permalink / raw)
  To: syzbot ci, biju.das.jz, davem, geert, kernel, kuba, linux-can,
	mailhol, mkl, netdev, stefan.maetje, stephane.grosjean,
	zhao.xichao
  Cc: syzbot, syzkaller-bugs

Hello Vincent,

On 24.09.25 14:40, syzbot ci wrote:
> syzbot ci has tested the following series
> 
> [v1] pull-request: can-next 2025-09-24
> https://lore.kernel.org/all/20250924082104.595459-1-mkl@pengutronix.de
> * [PATCH net-next 01/48] can: m_can: use us_to_ktime() where appropriate
> * [PATCH net-next 02/48] MAINTAINERS: update Vincent Mailhol's email address
> * [PATCH net-next 03/48] can: dev: sort includes by alphabetical order
> * [PATCH net-next 04/48] can: peak: Modification of references to email accounts being deleted
> * [PATCH net-next 05/48] can: rcar_canfd: Update bit rate constants for RZ/G3E and R-Car Gen4
> * [PATCH net-next 06/48] can: rcar_canfd: Update RCANFD_CFG_* macros
> * [PATCH net-next 07/48] can: rcar_canfd: Simplify nominal bit rate config
> * [PATCH net-next 08/48] can: rcar_canfd: Simplify data bit rate config
> * [PATCH net-next 09/48] can: rcar_can: Consistently use ndev for net_device pointers
> * [PATCH net-next 10/48] can: rcar_can: Add helper variable dev to rcar_can_probe()
> * [PATCH net-next 11/48] can: rcar_can: Convert to Runtime PM
> * [PATCH net-next 12/48] can: rcar_can: Convert to BIT()
> * [PATCH net-next 13/48] can: rcar_can: Convert to GENMASK()
> * [PATCH net-next 14/48] can: rcar_can: CTLR bitfield conversion
> * [PATCH net-next 15/48] can: rcar_can: TFCR bitfield conversion
> * [PATCH net-next 16/48] can: rcar_can: BCR bitfield conversion
> * [PATCH net-next 17/48] can: rcar_can: Mailbox bitfield conversion
> * [PATCH net-next 18/48] can: rcar_can: Do not print alloc_candev() failures
> * [PATCH net-next 19/48] can: rcar_can: Convert to %pe
> * [PATCH net-next 20/48] can: esd_usb: Rework display of error messages
> * [PATCH net-next 21/48] can: esd_usb: Avoid errors triggered from USB disconnect
> * [PATCH net-next 22/48] can: raw: reorder struct uniqframe's members to optimise packing
> * [PATCH net-next 23/48] can: raw: use bitfields to store flags in struct raw_sock
> * [PATCH net-next 24/48] can: raw: reorder struct raw_sock's members to optimise packing
> * [PATCH net-next 25/48] can: annotate mtu accesses with READ_ONCE()
> * [PATCH net-next 26/48] can: dev: turn can_set_static_ctrlmode() into a non-inline function
> * [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
> * [PATCH net-next 28/48] can: enable CAN XL for virtual CAN devices by default
> * [PATCH net-next 29/48] can: dev: move struct data_bittiming_params to linux/can/bittiming.h
> * [PATCH net-next 30/48] can: dev: make can_get_relative_tdco() FD agnostic and move it to bittiming.h
> * [PATCH net-next 31/48] can: netlink: document which symbols are FD specific
> * [PATCH net-next 32/48] can: netlink: refactor can_validate_bittiming()
> * [PATCH net-next 33/48] can: netlink: add can_validate_tdc()
> * [PATCH net-next 34/48] can: netlink: add can_validate_databittiming()
> * [PATCH net-next 35/48] can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL} flag reset logic
> * [PATCH net-next 36/48] can: netlink: remove useless check in can_tdc_changelink()
> * [PATCH net-next 37/48] can: netlink: make can_tdc_changelink() FD agnostic
> * [PATCH net-next 38/48] can: netlink: add can_dtb_changelink()
> * [PATCH net-next 39/48] can: netlink: add can_ctrlmode_changelink()
> * [PATCH net-next 40/48] can: netlink: make can_tdc_get_size() FD agnostic
> * [PATCH net-next 41/48] can: netlink: add can_data_bittiming_get_size()
> * [PATCH net-next 42/48] can: netlink: add can_bittiming_fill_info()
> * [PATCH net-next 43/48] can: netlink: add can_bittiming_const_fill_info()
> * [PATCH net-next 44/48] can: netlink: add can_bitrate_const_fill_info()
> * [PATCH net-next 45/48] can: netlink: make can_tdc_fill_info() FD agnostic
> * [PATCH net-next 46/48] can: calc_bittiming: make can_calc_tdco() FD agnostic
> * [PATCH net-next 47/48] can: dev: add can_get_ctrlmode_str()
> * [PATCH net-next 48/48] can: netlink: add userland error messages
> 
> and found the following issue:
> KASAN: slab-out-of-bounds Read in can_setup
> 
> Full report is available here:
> https://ci.syzbot.org/series/7feff13b-7247-438c-9d92-b8e9fda977c7
> 
> ***
> 
> KASAN: slab-out-of-bounds Read in can_setup
> 
> tree:      net-next
> URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next.git
> base:      315f423be0d1ebe720d8fd4fa6bed68586b13d34
> arch:      amd64
> compiler:  Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> config:    https://ci.syzbot.org/builds/08331a39-4a31-4f96-a377-3125df2af883/config
> C repro:   https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-bb9d2fdb1d79/c_repro
> syz repro: https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-bb9d2fdb1d79/syz_repro
> 
> netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'.
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]
> BUG: KASAN: slab-out-of-bounds in can_setup+0x209/0x280 drivers/net/can/dev/dev.c:279
> Read of size 4 at addr ffff888106a6ee74 by task syz.0.17/5999
> 
> CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> Call Trace:
>   <TASK>
>   dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
>   print_address_description mm/kasan/report.c:378 [inline]
>   print_report+0xca/0x240 mm/kasan/report.c:482
>   kasan_report+0x118/0x150 mm/kasan/report.c:595
>   can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]

When can_set_default_mtu() is called from the netlink config context it 
is also used for virtual CAN interfaces (which was created by syzbot 
here), where the priv pointer is not valid.

Please use

struct can_priv *priv = safe_candev_priv(dev);

to detect virtual CAN interfaces too.

Best regards,
Oliver

>   can_setup+0x209/0x280 drivers/net/can/dev/dev.c:279
>   alloc_netdev_mqs+0x795/0x11b0 net/core/dev.c:11949
>   rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3633
>   rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3815
>   __rtnl_newlink net/core/rtnetlink.c:3942 [inline]
>   rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4057
>   rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6946
>   netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
>   netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
>   netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
>   netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
>   sock_sendmsg_nosec net/socket.c:714 [inline]
>   __sock_sendmsg+0x21c/0x270 net/socket.c:729
>   ____sys_sendmsg+0x505/0x830 net/socket.c:2614
>   ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
>   __sys_sendmsg net/socket.c:2700 [inline]
>   __do_sys_sendmsg net/socket.c:2705 [inline]
>   __se_sys_sendmsg net/socket.c:2703 [inline]
>   __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
>   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f0b7658ec29
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fff71a7bdf8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
> RAX: ffffffffffffffda RBX: 00007f0b767d5fa0 RCX: 00007f0b7658ec29
> RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003
> RBP: 00007f0b76611e41 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f0b767d5fa0 R14: 00007f0b767d5fa0 R15: 0000000000000003
>   </TASK>
> 
> Allocated by task 5999:
>   kasan_save_stack mm/kasan/common.c:47 [inline]
>   kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
>   poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
>   __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
>   kasan_kmalloc include/linux/kasan.h:260 [inline]
>   __do_kmalloc_node mm/slub.c:4376 [inline]
>   __kvmalloc_node_noprof+0x30d/0x5f0 mm/slub.c:5067
>   alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11893
>   rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3633
>   rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3815
>   __rtnl_newlink net/core/rtnetlink.c:3942 [inline]
>   rtnl_newlink+0x16d6/0x1c70 net/core/rtnetlink.c:4057
>   rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6946
>   netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
>   netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
>   netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346
>   netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
>   sock_sendmsg_nosec net/socket.c:714 [inline]
>   __sock_sendmsg+0x21c/0x270 net/socket.c:729
>   ____sys_sendmsg+0x505/0x830 net/socket.c:2614
>   ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
>   __sys_sendmsg net/socket.c:2700 [inline]
>   __do_sys_sendmsg net/socket.c:2705 [inline]
>   __se_sys_sendmsg net/socket.c:2703 [inline]
>   __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
>   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>   do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> The buggy address belongs to the object at ffff888106a6e000
>   which belongs to the cache kmalloc-cg-4k of size 4096
> The buggy address is located 244 bytes to the right of
>   allocated 3456-byte region [ffff888106a6e000, ffff888106a6ed80)
> 
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106a68
> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> memcg:ffff88810e6ebb41
> flags: 0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
> page_type: f5(slab)
> raw: 057ff00000000040 ffff88801a44b500 ffffea00043e4000 dead000000000002
> raw: 0000000000000000 0000000080040004 00000000f5000000 ffff88810e6ebb41
> head: 057ff00000000040 ffff88801a44b500 ffffea00043e4000 dead000000000002
> head: 0000000000000000 0000000080040004 00000000f5000000 ffff88810e6ebb41
> head: 057ff00000000003 ffffea00041a9a01 00000000ffffffff 00000000ffffffff
> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5901, tgid 5901 (syz-executor), ts 69629116017, free_ts 69616324772
>   set_page_owner include/linux/page_owner.h:32 [inline]
>   post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
>   prep_new_page mm/page_alloc.c:1859 [inline]
>   get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
>   __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
>   alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
>   alloc_slab_page mm/slub.c:2492 [inline]
>   allocate_slab+0x8a/0x370 mm/slub.c:2660
>   new_slab mm/slub.c:2714 [inline]
>   ___slab_alloc+0xbeb/0x1420 mm/slub.c:3901
>   __slab_alloc mm/slub.c:3992 [inline]
>   __slab_alloc_node mm/slub.c:4067 [inline]
>   slab_alloc_node mm/slub.c:4228 [inline]
>   __do_kmalloc_node mm/slub.c:4375 [inline]
>   __kvmalloc_node_noprof+0x429/0x5f0 mm/slub.c:5067
>   alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11893
>   vti6_init_net+0x104/0x370 net/ipv6/ip6_vti.c:1146
>   ops_init+0x35c/0x5c0 net/core/net_namespace.c:136
>   setup_net+0x10c/0x320 net/core/net_namespace.c:438
>   copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570
>   create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110
>   unshare_nsproxy_namespaces+0x11c/0x170 kernel/nsproxy.c:218
>   ksys_unshare+0x4c8/0x8c0 kernel/fork.c:3127
>   __do_sys_unshare kernel/fork.c:3198 [inline]
>   __se_sys_unshare kernel/fork.c:3196 [inline]
>   __x64_sys_unshare+0x38/0x50 kernel/fork.c:3196
> page last free pid 5901 tgid 5901 stack trace:
>   reset_page_owner include/linux/page_owner.h:25 [inline]
>   free_pages_prepare mm/page_alloc.c:1395 [inline]
>   __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
>   __slab_free+0x303/0x3c0 mm/slub.c:4606
>   qlink_free mm/kasan/quarantine.c:163 [inline]
>   qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
>   kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
>   __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:340
>   kasan_slab_alloc include/linux/kasan.h:250 [inline]
>   slab_post_alloc_hook mm/slub.c:4191 [inline]
>   slab_alloc_node mm/slub.c:4240 [inline]
>   __kmalloc_cache_noprof+0x1be/0x3d0 mm/slub.c:4402
>   kmalloc_noprof include/linux/slab.h:905 [inline]
>   kzalloc_noprof include/linux/slab.h:1039 [inline]
>   ref_tracker_alloc+0x133/0x460 lib/ref_tracker.c:271
>   __netdev_tracker_alloc include/linux/netdevice.h:4379 [inline]
>   netdev_hold include/linux/netdevice.h:4408 [inline]
>   netdev_queue_add_kobject net/core/net-sysfs.c:1994 [inline]
>   netdev_queue_update_kobjects+0x1d1/0x6c0 net/core/net-sysfs.c:2056
>   register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
>   netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2362
>   register_netdevice+0x126c/0x1ae0 net/core/dev.c:11287
>   __ip_tunnel_create+0x3e7/0x560 net/ipv4/ip_tunnel.c:268
>   ip_tunnel_init_net+0x2ba/0x800 net/ipv4/ip_tunnel.c:1161
>   ops_init+0x35c/0x5c0 net/core/net_namespace.c:136
>   setup_net+0x10c/0x320 net/core/net_namespace.c:438
>   copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570
>   create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110
> 
> Memory state around the buggy address:
>   ffff888106a6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   ffff888106a6ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>> ffff888106a6ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>                                                               ^
>   ffff888106a6ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>   ffff888106a6ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> ==================================================================
> 
> 
> ***
> 
> If these findings have caused you to resend the series or submit a
> separate fix, please add the following tag to your commit message:
>    Tested-by: syzbot@syzkaller.appspotmail.com
> 
> ---
> This report is generated by a bot. It may contain errors.
> syzbot ci engineers can be reached at syzkaller@googlegroups.com.


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot ci] Re: pull-request: can-next 2025-09-24
  2025-09-24 13:18   ` Oliver Hartkopp
@ 2025-09-24 13:31     ` Vincent Mailhol
  2025-09-24 13:38       ` Marc Kleine-Budde
  2025-09-24 13:38       ` Oliver Hartkopp
  0 siblings, 2 replies; 9+ messages in thread
From: Vincent Mailhol @ 2025-09-24 13:31 UTC (permalink / raw)
  To: Oliver Hartkopp
  Cc: syzbot, syzkaller-bugs, syzbot ci, biju.das.jz, davem, geert,
	kernel, kuba, linux-can, mkl, netdev, stefan.maetje,
	stephane.grosjean, zhao.xichao

On 24/09/2025 at 22:18, Oliver Hartkopp wrote:
> Hello Vincent,
> 
> On 24.09.25 14:40, syzbot ci wrote:
>> syzbot ci has tested the following series
>>
>> [v1] pull-request: can-next 2025-09-24
>> https://lore.kernel.org/all/20250924082104.595459-1-mkl@pengutronix.de
>> * [PATCH net-next 01/48] can: m_can: use us_to_ktime() where appropriate
>> * [PATCH net-next 02/48] MAINTAINERS: update Vincent Mailhol's email address
>> * [PATCH net-next 03/48] can: dev: sort includes by alphabetical order
>> * [PATCH net-next 04/48] can: peak: Modification of references to email
>> accounts being deleted
>> * [PATCH net-next 05/48] can: rcar_canfd: Update bit rate constants for RZ/G3E
>> and R-Car Gen4
>> * [PATCH net-next 06/48] can: rcar_canfd: Update RCANFD_CFG_* macros
>> * [PATCH net-next 07/48] can: rcar_canfd: Simplify nominal bit rate config
>> * [PATCH net-next 08/48] can: rcar_canfd: Simplify data bit rate config
>> * [PATCH net-next 09/48] can: rcar_can: Consistently use ndev for net_device
>> pointers
>> * [PATCH net-next 10/48] can: rcar_can: Add helper variable dev to
>> rcar_can_probe()
>> * [PATCH net-next 11/48] can: rcar_can: Convert to Runtime PM
>> * [PATCH net-next 12/48] can: rcar_can: Convert to BIT()
>> * [PATCH net-next 13/48] can: rcar_can: Convert to GENMASK()
>> * [PATCH net-next 14/48] can: rcar_can: CTLR bitfield conversion
>> * [PATCH net-next 15/48] can: rcar_can: TFCR bitfield conversion
>> * [PATCH net-next 16/48] can: rcar_can: BCR bitfield conversion
>> * [PATCH net-next 17/48] can: rcar_can: Mailbox bitfield conversion
>> * [PATCH net-next 18/48] can: rcar_can: Do not print alloc_candev() failures
>> * [PATCH net-next 19/48] can: rcar_can: Convert to %pe
>> * [PATCH net-next 20/48] can: esd_usb: Rework display of error messages
>> * [PATCH net-next 21/48] can: esd_usb: Avoid errors triggered from USB disconnect
>> * [PATCH net-next 22/48] can: raw: reorder struct uniqframe's members to
>> optimise packing
>> * [PATCH net-next 23/48] can: raw: use bitfields to store flags in struct
>> raw_sock
>> * [PATCH net-next 24/48] can: raw: reorder struct raw_sock's members to
>> optimise packing
>> * [PATCH net-next 25/48] can: annotate mtu accesses with READ_ONCE()
>> * [PATCH net-next 26/48] can: dev: turn can_set_static_ctrlmode() into a non-
>> inline function
>> * [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
>> * [PATCH net-next 28/48] can: enable CAN XL for virtual CAN devices by default
>> * [PATCH net-next 29/48] can: dev: move struct data_bittiming_params to linux/
>> can/bittiming.h
>> * [PATCH net-next 30/48] can: dev: make can_get_relative_tdco() FD agnostic
>> and move it to bittiming.h
>> * [PATCH net-next 31/48] can: netlink: document which symbols are FD specific
>> * [PATCH net-next 32/48] can: netlink: refactor can_validate_bittiming()
>> * [PATCH net-next 33/48] can: netlink: add can_validate_tdc()
>> * [PATCH net-next 34/48] can: netlink: add can_validate_databittiming()
>> * [PATCH net-next 35/48] can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL}
>> flag reset logic
>> * [PATCH net-next 36/48] can: netlink: remove useless check in
>> can_tdc_changelink()
>> * [PATCH net-next 37/48] can: netlink: make can_tdc_changelink() FD agnostic
>> * [PATCH net-next 38/48] can: netlink: add can_dtb_changelink()
>> * [PATCH net-next 39/48] can: netlink: add can_ctrlmode_changelink()
>> * [PATCH net-next 40/48] can: netlink: make can_tdc_get_size() FD agnostic
>> * [PATCH net-next 41/48] can: netlink: add can_data_bittiming_get_size()
>> * [PATCH net-next 42/48] can: netlink: add can_bittiming_fill_info()
>> * [PATCH net-next 43/48] can: netlink: add can_bittiming_const_fill_info()
>> * [PATCH net-next 44/48] can: netlink: add can_bitrate_const_fill_info()
>> * [PATCH net-next 45/48] can: netlink: make can_tdc_fill_info() FD agnostic
>> * [PATCH net-next 46/48] can: calc_bittiming: make can_calc_tdco() FD agnostic
>> * [PATCH net-next 47/48] can: dev: add can_get_ctrlmode_str()
>> * [PATCH net-next 48/48] can: netlink: add userland error messages
>>
>> and found the following issue:
>> KASAN: slab-out-of-bounds Read in can_setup
>>
>> Full report is available here:
>> https://ci.syzbot.org/series/7feff13b-7247-438c-9d92-b8e9fda977c7
>>
>> ***
>>
>> KASAN: slab-out-of-bounds Read in can_setup
>>
>> tree:      net-next
>> URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/
>> net-next.git
>> base:      315f423be0d1ebe720d8fd4fa6bed68586b13d34
>> arch:      amd64
>> compiler:  Debian clang version 20.1.8 (+
>> +20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>> config:    https://ci.syzbot.org/builds/08331a39-4a31-4f96-a377-3125df2af883/
>> config
>> C repro:   https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-
>> bb9d2fdb1d79/c_repro
>> syz repro: https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-
>> bb9d2fdb1d79/syz_repro
>>
>> netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'.
>> ==================================================================
>> BUG: KASAN: slab-out-of-bounds in can_set_default_mtu drivers/net/can/dev/
>> dev.c:350 [inline]
>> BUG: KASAN: slab-out-of-bounds in can_setup+0x209/0x280 drivers/net/can/dev/
>> dev.c:279
>> Read of size 4 at addr ffff888106a6ee74 by task syz.0.17/5999
>>
>> CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
>> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-
>> debian-1.16.2-1 04/01/2014
>> Call Trace:
>>   <TASK>
>>   dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
>>   print_address_description mm/kasan/report.c:378 [inline]
>>   print_report+0xca/0x240 mm/kasan/report.c:482
>>   kasan_report+0x118/0x150 mm/kasan/report.c:595
>>   can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]
> 
> When can_set_default_mtu() is called from the netlink config context it is also
> used for virtual CAN interfaces (which was created by syzbot here), where the
> priv pointer is not valid.

Ack. I am pretty sure that I tested it on the virtual interfaces, but I did not
have KASAN activated. So I did not notice the problem.

> Please use
> 
> struct can_priv *priv = safe_candev_priv(dev);
> 
> to detect virtual CAN interfaces too.

Exactly! I am reaching the same conclusion.

Right now, I am testing this patch:

diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index e5a82aa77958..1a309ae4850d 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -345,9 +345,9 @@ EXPORT_SYMBOL_GPL(free_candev);

 void can_set_default_mtu(struct net_device *dev)
 {
-       struct can_priv *priv = netdev_priv(dev);
+       struct can_priv *priv = safe_candev_priv(dev);

-       if (priv->ctrlmode & CAN_CTRLMODE_FD) {
+       if (priv && (priv->ctrlmode & CAN_CTRLMODE_FD)) {
                dev->mtu = CANFD_MTU;
                dev->min_mtu = CANFD_MTU;
                dev->max_mtu = CANFD_MTU;

It is compiling rigth now. Another potential fix could also be:

diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index e5a82aa77958..66c7a9eee7dd 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -273,11 +273,12 @@ void can_setup(struct net_device *dev)
 {
        dev->type = ARPHRD_CAN;
        dev->hard_header_len = 0;
+       dev->mtu = CAN_MTU;
+       dev->min_mtu = CAN_MTU;
+       dev->max_mtu = CAN_MTU;
        dev->addr_len = 0;
        dev->tx_queue_len = 10;

-       can_set_default_mtu(dev);
-
        /* New-style flags. */
        dev->flags = IFF_NOARP;
        dev->features = NETIF_F_HW_CSUM;


@Marc, once I finish testing, can I just send you a diff patch and ask to squash
it in:

  [PATCH net-next 27/48] can: populate the minimum and maximum MTU values

?


Yours sincerely,
Vincent Mailhol


^ permalink raw reply related	[flat|nested] 9+ messages in thread

* Re: [syzbot ci] Re: pull-request: can-next 2025-09-24
  2025-09-24 13:31     ` Vincent Mailhol
@ 2025-09-24 13:38       ` Marc Kleine-Budde
  2025-09-24 13:38       ` Oliver Hartkopp
  1 sibling, 0 replies; 9+ messages in thread
From: Marc Kleine-Budde @ 2025-09-24 13:38 UTC (permalink / raw)
  To: Vincent Mailhol
  Cc: Oliver Hartkopp, syzbot, syzkaller-bugs, syzbot ci, biju.das.jz,
	davem, geert, kernel, kuba, linux-can, netdev, stefan.maetje,
	stephane.grosjean, zhao.xichao

[-- Attachment #1: Type: text/plain, Size: 515 bytes --]

On 24.09.2025 22:31:28, Vincent Mailhol wrote:
> @Marc, once I finish testing, can I just send you a diff patch and ask to squash
> it in:
> 
>   [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
> 
> ?

ACK

Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot ci] Re: pull-request: can-next 2025-09-24
  2025-09-24 13:31     ` Vincent Mailhol
  2025-09-24 13:38       ` Marc Kleine-Budde
@ 2025-09-24 13:38       ` Oliver Hartkopp
  2025-09-24 14:14         ` Vincent Mailhol
  1 sibling, 1 reply; 9+ messages in thread
From: Oliver Hartkopp @ 2025-09-24 13:38 UTC (permalink / raw)
  To: Vincent Mailhol
  Cc: syzbot, syzkaller-bugs, syzbot ci, biju.das.jz, davem, geert,
	kernel, kuba, linux-can, mkl, netdev, stefan.maetje,
	stephane.grosjean, zhao.xichao



On 24.09.25 15:31, Vincent Mailhol wrote:
> On 24/09/2025 at 22:18, Oliver Hartkopp wrote:
>> Hello Vincent,
>>
>> On 24.09.25 14:40, syzbot ci wrote:
>>> syzbot ci has tested the following series
>>>
>>> [v1] pull-request: can-next 2025-09-24
>>> https://lore.kernel.org/all/20250924082104.595459-1-mkl@pengutronix.de
>>> * [PATCH net-next 01/48] can: m_can: use us_to_ktime() where appropriate
>>> * [PATCH net-next 02/48] MAINTAINERS: update Vincent Mailhol's email address
>>> * [PATCH net-next 03/48] can: dev: sort includes by alphabetical order
>>> * [PATCH net-next 04/48] can: peak: Modification of references to email
>>> accounts being deleted
>>> * [PATCH net-next 05/48] can: rcar_canfd: Update bit rate constants for RZ/G3E
>>> and R-Car Gen4
>>> * [PATCH net-next 06/48] can: rcar_canfd: Update RCANFD_CFG_* macros
>>> * [PATCH net-next 07/48] can: rcar_canfd: Simplify nominal bit rate config
>>> * [PATCH net-next 08/48] can: rcar_canfd: Simplify data bit rate config
>>> * [PATCH net-next 09/48] can: rcar_can: Consistently use ndev for net_device
>>> pointers
>>> * [PATCH net-next 10/48] can: rcar_can: Add helper variable dev to
>>> rcar_can_probe()
>>> * [PATCH net-next 11/48] can: rcar_can: Convert to Runtime PM
>>> * [PATCH net-next 12/48] can: rcar_can: Convert to BIT()
>>> * [PATCH net-next 13/48] can: rcar_can: Convert to GENMASK()
>>> * [PATCH net-next 14/48] can: rcar_can: CTLR bitfield conversion
>>> * [PATCH net-next 15/48] can: rcar_can: TFCR bitfield conversion
>>> * [PATCH net-next 16/48] can: rcar_can: BCR bitfield conversion
>>> * [PATCH net-next 17/48] can: rcar_can: Mailbox bitfield conversion
>>> * [PATCH net-next 18/48] can: rcar_can: Do not print alloc_candev() failures
>>> * [PATCH net-next 19/48] can: rcar_can: Convert to %pe
>>> * [PATCH net-next 20/48] can: esd_usb: Rework display of error messages
>>> * [PATCH net-next 21/48] can: esd_usb: Avoid errors triggered from USB disconnect
>>> * [PATCH net-next 22/48] can: raw: reorder struct uniqframe's members to
>>> optimise packing
>>> * [PATCH net-next 23/48] can: raw: use bitfields to store flags in struct
>>> raw_sock
>>> * [PATCH net-next 24/48] can: raw: reorder struct raw_sock's members to
>>> optimise packing
>>> * [PATCH net-next 25/48] can: annotate mtu accesses with READ_ONCE()
>>> * [PATCH net-next 26/48] can: dev: turn can_set_static_ctrlmode() into a non-
>>> inline function
>>> * [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
>>> * [PATCH net-next 28/48] can: enable CAN XL for virtual CAN devices by default
>>> * [PATCH net-next 29/48] can: dev: move struct data_bittiming_params to linux/
>>> can/bittiming.h
>>> * [PATCH net-next 30/48] can: dev: make can_get_relative_tdco() FD agnostic
>>> and move it to bittiming.h
>>> * [PATCH net-next 31/48] can: netlink: document which symbols are FD specific
>>> * [PATCH net-next 32/48] can: netlink: refactor can_validate_bittiming()
>>> * [PATCH net-next 33/48] can: netlink: add can_validate_tdc()
>>> * [PATCH net-next 34/48] can: netlink: add can_validate_databittiming()
>>> * [PATCH net-next 35/48] can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL}
>>> flag reset logic
>>> * [PATCH net-next 36/48] can: netlink: remove useless check in
>>> can_tdc_changelink()
>>> * [PATCH net-next 37/48] can: netlink: make can_tdc_changelink() FD agnostic
>>> * [PATCH net-next 38/48] can: netlink: add can_dtb_changelink()
>>> * [PATCH net-next 39/48] can: netlink: add can_ctrlmode_changelink()
>>> * [PATCH net-next 40/48] can: netlink: make can_tdc_get_size() FD agnostic
>>> * [PATCH net-next 41/48] can: netlink: add can_data_bittiming_get_size()
>>> * [PATCH net-next 42/48] can: netlink: add can_bittiming_fill_info()
>>> * [PATCH net-next 43/48] can: netlink: add can_bittiming_const_fill_info()
>>> * [PATCH net-next 44/48] can: netlink: add can_bitrate_const_fill_info()
>>> * [PATCH net-next 45/48] can: netlink: make can_tdc_fill_info() FD agnostic
>>> * [PATCH net-next 46/48] can: calc_bittiming: make can_calc_tdco() FD agnostic
>>> * [PATCH net-next 47/48] can: dev: add can_get_ctrlmode_str()
>>> * [PATCH net-next 48/48] can: netlink: add userland error messages
>>>
>>> and found the following issue:
>>> KASAN: slab-out-of-bounds Read in can_setup
>>>
>>> Full report is available here:
>>> https://ci.syzbot.org/series/7feff13b-7247-438c-9d92-b8e9fda977c7
>>>
>>> ***
>>>
>>> KASAN: slab-out-of-bounds Read in can_setup
>>>
>>> tree:      net-next
>>> URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/
>>> net-next.git
>>> base:      315f423be0d1ebe720d8fd4fa6bed68586b13d34
>>> arch:      amd64
>>> compiler:  Debian clang version 20.1.8 (+
>>> +20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>> config:    https://ci.syzbot.org/builds/08331a39-4a31-4f96-a377-3125df2af883/
>>> config
>>> C repro:   https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-
>>> bb9d2fdb1d79/c_repro
>>> syz repro: https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-
>>> bb9d2fdb1d79/syz_repro
>>>
>>> netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'.
>>> ==================================================================
>>> BUG: KASAN: slab-out-of-bounds in can_set_default_mtu drivers/net/can/dev/
>>> dev.c:350 [inline]
>>> BUG: KASAN: slab-out-of-bounds in can_setup+0x209/0x280 drivers/net/can/dev/
>>> dev.c:279
>>> Read of size 4 at addr ffff888106a6ee74 by task syz.0.17/5999
>>>
>>> CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
>>> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-
>>> debian-1.16.2-1 04/01/2014
>>> Call Trace:
>>>    <TASK>
>>>    dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
>>>    print_address_description mm/kasan/report.c:378 [inline]
>>>    print_report+0xca/0x240 mm/kasan/report.c:482
>>>    kasan_report+0x118/0x150 mm/kasan/report.c:595
>>>    can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]
>>
>> When can_set_default_mtu() is called from the netlink config context it is also
>> used for virtual CAN interfaces (which was created by syzbot here), where the
>> priv pointer is not valid.
> 
> Ack. I am pretty sure that I tested it on the virtual interfaces, but I did not
> have KASAN activated. So I did not notice the problem.
> 
>> Please use
>>
>> struct can_priv *priv = safe_candev_priv(dev);
>>
>> to detect virtual CAN interfaces too.
> 
> Exactly! I am reaching the same conclusion.
> 
> Right now, I am testing this patch:
> 
> diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
> index e5a82aa77958..1a309ae4850d 100644
> --- a/drivers/net/can/dev/dev.c
> +++ b/drivers/net/can/dev/dev.c
> @@ -345,9 +345,9 @@ EXPORT_SYMBOL_GPL(free_candev);
> 
>   void can_set_default_mtu(struct net_device *dev)
>   {
> -       struct can_priv *priv = netdev_priv(dev);
> +       struct can_priv *priv = safe_candev_priv(dev);
> 
> -       if (priv->ctrlmode & CAN_CTRLMODE_FD) {
> +       if (priv && (priv->ctrlmode & CAN_CTRLMODE_FD)) {
>                  dev->mtu = CANFD_MTU;
>                  dev->min_mtu = CANFD_MTU;
>                  dev->max_mtu = CANFD_MTU;
> 
> It is compiling rigth now. Another potential fix could also be:
> 
> diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
> index e5a82aa77958..66c7a9eee7dd 100644
> --- a/drivers/net/can/dev/dev.c
> +++ b/drivers/net/can/dev/dev.c
> @@ -273,11 +273,12 @@ void can_setup(struct net_device *dev)
>   {
>          dev->type = ARPHRD_CAN;
>          dev->hard_header_len = 0;
> +       dev->mtu = CAN_MTU;
> +       dev->min_mtu = CAN_MTU;
> +       dev->max_mtu = CAN_MTU;
>          dev->addr_len = 0;
>          dev->tx_queue_len = 10;
> 
> -       can_set_default_mtu(dev);
> -
>          /* New-style flags. */
>          dev->flags = IFF_NOARP;
>          dev->features = NETIF_F_HW_CSUM;
> 

I tend to prefer this kind of fix.

This would make clear that can_set_default_mtu() is only triggered when 
a new netlink configuration process on real(!) CAN interfaces is finalized.

Maybe this restriction should go into a comment describing 
can_set_default_mtu() then.

Best regards,
Oliver

> @Marc, once I finish testing, can I just send you a diff patch and ask to squash
> it in:
> 
>    [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
> 
> ?
> 
> 
> Yours sincerely,
> Vincent Mailhol
> 
> 


^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [syzbot ci] Re: pull-request: can-next 2025-09-24
  2025-09-24 13:38       ` Oliver Hartkopp
@ 2025-09-24 14:14         ` Vincent Mailhol
  0 siblings, 0 replies; 9+ messages in thread
From: Vincent Mailhol @ 2025-09-24 14:14 UTC (permalink / raw)
  To: Oliver Hartkopp
  Cc: syzbot, syzkaller-bugs, syzbot ci, biju.das.jz, davem, geert,
	kernel, kuba, linux-can, mkl, netdev, stefan.maetje,
	stephane.grosjean, zhao.xichao

On 24/09/2025 at 22:38, Oliver Hartkopp wrote:
> On 24.09.25 15:31, Vincent Mailhol wrote:
>> On 24/09/2025 at 22:18, Oliver Hartkopp wrote:
>>> Hello Vincent,
>>>
>>> On 24.09.25 14:40, syzbot ci wrote:
>>>> syzbot ci has tested the following series
>>>>
>>>> [v1] pull-request: can-next 2025-09-24
>>>> https://lore.kernel.org/all/20250924082104.595459-1-mkl@pengutronix.de
>>>> * [PATCH net-next 01/48] can: m_can: use us_to_ktime() where appropriate
>>>> * [PATCH net-next 02/48] MAINTAINERS: update Vincent Mailhol's email address
>>>> * [PATCH net-next 03/48] can: dev: sort includes by alphabetical order
>>>> * [PATCH net-next 04/48] can: peak: Modification of references to email
>>>> accounts being deleted
>>>> * [PATCH net-next 05/48] can: rcar_canfd: Update bit rate constants for RZ/G3E
>>>> and R-Car Gen4
>>>> * [PATCH net-next 06/48] can: rcar_canfd: Update RCANFD_CFG_* macros
>>>> * [PATCH net-next 07/48] can: rcar_canfd: Simplify nominal bit rate config
>>>> * [PATCH net-next 08/48] can: rcar_canfd: Simplify data bit rate config
>>>> * [PATCH net-next 09/48] can: rcar_can: Consistently use ndev for net_device
>>>> pointers
>>>> * [PATCH net-next 10/48] can: rcar_can: Add helper variable dev to
>>>> rcar_can_probe()
>>>> * [PATCH net-next 11/48] can: rcar_can: Convert to Runtime PM
>>>> * [PATCH net-next 12/48] can: rcar_can: Convert to BIT()
>>>> * [PATCH net-next 13/48] can: rcar_can: Convert to GENMASK()
>>>> * [PATCH net-next 14/48] can: rcar_can: CTLR bitfield conversion
>>>> * [PATCH net-next 15/48] can: rcar_can: TFCR bitfield conversion
>>>> * [PATCH net-next 16/48] can: rcar_can: BCR bitfield conversion
>>>> * [PATCH net-next 17/48] can: rcar_can: Mailbox bitfield conversion
>>>> * [PATCH net-next 18/48] can: rcar_can: Do not print alloc_candev() failures
>>>> * [PATCH net-next 19/48] can: rcar_can: Convert to %pe
>>>> * [PATCH net-next 20/48] can: esd_usb: Rework display of error messages
>>>> * [PATCH net-next 21/48] can: esd_usb: Avoid errors triggered from USB
>>>> disconnect
>>>> * [PATCH net-next 22/48] can: raw: reorder struct uniqframe's members to
>>>> optimise packing
>>>> * [PATCH net-next 23/48] can: raw: use bitfields to store flags in struct
>>>> raw_sock
>>>> * [PATCH net-next 24/48] can: raw: reorder struct raw_sock's members to
>>>> optimise packing
>>>> * [PATCH net-next 25/48] can: annotate mtu accesses with READ_ONCE()
>>>> * [PATCH net-next 26/48] can: dev: turn can_set_static_ctrlmode() into a non-
>>>> inline function
>>>> * [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
>>>> * [PATCH net-next 28/48] can: enable CAN XL for virtual CAN devices by default
>>>> * [PATCH net-next 29/48] can: dev: move struct data_bittiming_params to linux/
>>>> can/bittiming.h
>>>> * [PATCH net-next 30/48] can: dev: make can_get_relative_tdco() FD agnostic
>>>> and move it to bittiming.h
>>>> * [PATCH net-next 31/48] can: netlink: document which symbols are FD specific
>>>> * [PATCH net-next 32/48] can: netlink: refactor can_validate_bittiming()
>>>> * [PATCH net-next 33/48] can: netlink: add can_validate_tdc()
>>>> * [PATCH net-next 34/48] can: netlink: add can_validate_databittiming()
>>>> * [PATCH net-next 35/48] can: netlink: refactor CAN_CTRLMODE_TDC_{AUTO,MANUAL}
>>>> flag reset logic
>>>> * [PATCH net-next 36/48] can: netlink: remove useless check in
>>>> can_tdc_changelink()
>>>> * [PATCH net-next 37/48] can: netlink: make can_tdc_changelink() FD agnostic
>>>> * [PATCH net-next 38/48] can: netlink: add can_dtb_changelink()
>>>> * [PATCH net-next 39/48] can: netlink: add can_ctrlmode_changelink()
>>>> * [PATCH net-next 40/48] can: netlink: make can_tdc_get_size() FD agnostic
>>>> * [PATCH net-next 41/48] can: netlink: add can_data_bittiming_get_size()
>>>> * [PATCH net-next 42/48] can: netlink: add can_bittiming_fill_info()
>>>> * [PATCH net-next 43/48] can: netlink: add can_bittiming_const_fill_info()
>>>> * [PATCH net-next 44/48] can: netlink: add can_bitrate_const_fill_info()
>>>> * [PATCH net-next 45/48] can: netlink: make can_tdc_fill_info() FD agnostic
>>>> * [PATCH net-next 46/48] can: calc_bittiming: make can_calc_tdco() FD agnostic
>>>> * [PATCH net-next 47/48] can: dev: add can_get_ctrlmode_str()
>>>> * [PATCH net-next 48/48] can: netlink: add userland error messages
>>>>
>>>> and found the following issue:
>>>> KASAN: slab-out-of-bounds Read in can_setup
>>>>
>>>> Full report is available here:
>>>> https://ci.syzbot.org/series/7feff13b-7247-438c-9d92-b8e9fda977c7
>>>>
>>>> ***
>>>>
>>>> KASAN: slab-out-of-bounds Read in can_setup
>>>>
>>>> tree:      net-next
>>>> URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/
>>>> net-next.git
>>>> base:      315f423be0d1ebe720d8fd4fa6bed68586b13d34
>>>> arch:      amd64
>>>> compiler:  Debian clang version 20.1.8 (+
>>>> +20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
>>>> config:    https://ci.syzbot.org/builds/08331a39-4a31-4f96-a377-3125df2af883/
>>>> config
>>>> C repro:   https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-
>>>> bb9d2fdb1d79/c_repro
>>>> syz repro: https://ci.syzbot.org/findings/46cae752-cb54-4ceb-87cb-
>>>> bb9d2fdb1d79/syz_repro
>>>>
>>>> netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'.
>>>> ==================================================================
>>>> BUG: KASAN: slab-out-of-bounds in can_set_default_mtu drivers/net/can/dev/
>>>> dev.c:350 [inline]
>>>> BUG: KASAN: slab-out-of-bounds in can_setup+0x209/0x280 drivers/net/can/dev/
>>>> dev.c:279
>>>> Read of size 4 at addr ffff888106a6ee74 by task syz.0.17/5999
>>>>
>>>> CPU: 1 UID: 0 PID: 5999 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
>>>> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-
>>>> debian-1.16.2-1 04/01/2014
>>>> Call Trace:
>>>>    <TASK>
>>>>    dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
>>>>    print_address_description mm/kasan/report.c:378 [inline]
>>>>    print_report+0xca/0x240 mm/kasan/report.c:482
>>>>    kasan_report+0x118/0x150 mm/kasan/report.c:595
>>>>    can_set_default_mtu drivers/net/can/dev/dev.c:350 [inline]
>>>
>>> When can_set_default_mtu() is called from the netlink config context it is also
>>> used for virtual CAN interfaces (which was created by syzbot here), where the
>>> priv pointer is not valid.
>>
>> Ack. I am pretty sure that I tested it on the virtual interfaces, but I did not
>> have KASAN activated. So I did not notice the problem.
>>
>>> Please use
>>>
>>> struct can_priv *priv = safe_candev_priv(dev);
>>>
>>> to detect virtual CAN interfaces too.
>>
>> Exactly! I am reaching the same conclusion.
>>
>> Right now, I am testing this patch:
>>
>> diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
>> index e5a82aa77958..1a309ae4850d 100644
>> --- a/drivers/net/can/dev/dev.c
>> +++ b/drivers/net/can/dev/dev.c
>> @@ -345,9 +345,9 @@ EXPORT_SYMBOL_GPL(free_candev);
>>
>>   void can_set_default_mtu(struct net_device *dev)
>>   {
>> -       struct can_priv *priv = netdev_priv(dev);
>> +       struct can_priv *priv = safe_candev_priv(dev);
>>
>> -       if (priv->ctrlmode & CAN_CTRLMODE_FD) {
>> +       if (priv && (priv->ctrlmode & CAN_CTRLMODE_FD)) {
>>                  dev->mtu = CANFD_MTU;
>>                  dev->min_mtu = CANFD_MTU;
>>                  dev->max_mtu = CANFD_MTU;
>>
>> It is compiling rigth now. Another potential fix could also be:
>>
>> diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
>> index e5a82aa77958..66c7a9eee7dd 100644
>> --- a/drivers/net/can/dev/dev.c
>> +++ b/drivers/net/can/dev/dev.c
>> @@ -273,11 +273,12 @@ void can_setup(struct net_device *dev)
>>   {
>>          dev->type = ARPHRD_CAN;
>>          dev->hard_header_len = 0;
>> +       dev->mtu = CAN_MTU;
>> +       dev->min_mtu = CAN_MTU;
>> +       dev->max_mtu = CAN_MTU;
>>          dev->addr_len = 0;
>>          dev->tx_queue_len = 10;
>>
>> -       can_set_default_mtu(dev);
>> -
>>          /* New-style flags. */
>>          dev->flags = IFF_NOARP;
>>          dev->features = NETIF_F_HW_CSUM;
>>
> 
> I tend to prefer this kind of fix.
> 
> This would make clear that can_set_default_mtu() is only triggered when a new
> netlink configuration process on real(!) CAN interfaces is finalized.
> 
> Maybe this restriction should go into a comment describing can_set_default_mtu()
> then.

Actually, it *must* be this second fix. can_setup() is used as a callback
function in alloc_netdev_mqs(). At the moment this callback is called, priv is
not yet fully setup and thus, safe_candev_priv() would fail on physical
interfaces. In other words, safe_candev_priv() is solving the problem for
virtual interfaces, but adding another issue for physical interfaces.

I am writing the diff patch now.


Yours sincerely,
Vincent Mailhol


^ permalink raw reply	[flat|nested] 9+ messages in thread

* [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu()
  2025-09-24 12:40 ` [syzbot ci] Re: pull-request: can-next 2025-09-24 syzbot ci
  2025-09-24 13:18   ` Oliver Hartkopp
@ 2025-09-24 14:35   ` Vincent Mailhol
  2025-09-24 15:13     ` Marc Kleine-Budde
  1 sibling, 1 reply; 9+ messages in thread
From: Vincent Mailhol @ 2025-09-24 14:35 UTC (permalink / raw)
  To: Oliver Hartkopp, mkl
  Cc: syzbot, syzkaller-bugs, syzbot ci, biju.das.jz, davem, geert,
	kernel, kuba, linux-can, netdev, stefan.maetje, stephane.grosjean,
	zhao.xichao, Vincent Mailhol

Under normal usage, the virtual interfaces do not call can_setup(),
unless if trigger by a call to can_link_ops->setup().

Patch [1] did not consider this scenario resulting in an out of bound
read in can_setup() when calling can_link_ops->setup() as reported by
syzbot ci in [2].

Replacing netdev_priv() by safe_candev_priv() may look like a
potential solution at first glance but is not: can_setup() is used as
a callback function in alloc_netdev_mqs(). At the moment this callback
is called, priv is not yet fully setup and thus, safe_candev_priv()
would fail on physical interfaces. In other words, safe_candev_priv()
is solving the problem for virtual interfaces, but adding another
issue for physical interfaces.

Remove the call to can_set_default_mtu() in can_setup(). Instead,
manually set the MTU the default CAN MTU. This decorrelates the two
functions, effectively removing the conflict.

[1] can: populate the minimum and maximum MTU values
Link: https://lore.kernel.org/linux-can/20250923-can-fix-mtu-v3-3-581bde113f52@kernel.org/

[2] https://lore.kernel.org/linux-can/68d3e6ce.a70a0220.4f78.0028.GAE@google.com/

Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
---
@Marc, please squash in

  [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
---
 drivers/net/can/dev/dev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c
index e5a82aa77958..15ccedbb3f8d 100644
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -272,12 +272,13 @@ EXPORT_SYMBOL_GPL(can_bus_off);
 void can_setup(struct net_device *dev)
 {
 	dev->type = ARPHRD_CAN;
+	dev->mtu = CAN_MTU;
+	dev->min_mtu = CAN_MTU;
+	dev->max_mtu = CAN_MTU;
 	dev->hard_header_len = 0;
 	dev->addr_len = 0;
 	dev->tx_queue_len = 10;

-	can_set_default_mtu(dev);
-
 	/* New-style flags. */
 	dev->flags = IFF_NOARP;
 	dev->features = NETIF_F_HW_CSUM;
-- 
2.49.1

^ permalink raw reply related	[flat|nested] 9+ messages in thread

* Re: [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu()
  2025-09-24 14:35   ` [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu() Vincent Mailhol
@ 2025-09-24 15:13     ` Marc Kleine-Budde
  2025-09-24 15:21       ` Vincent Mailhol
  0 siblings, 1 reply; 9+ messages in thread
From: Marc Kleine-Budde @ 2025-09-24 15:13 UTC (permalink / raw)
  To: Vincent Mailhol
  Cc: Oliver Hartkopp, syzbot, syzkaller-bugs, syzbot ci, biju.das.jz,
	davem, geert, kernel, kuba, linux-can, netdev, stefan.maetje,
	stephane.grosjean, zhao.xichao

[-- Attachment #1: Type: text/plain, Size: 1919 bytes --]

On 24.09.2025 23:35:44, Vincent Mailhol wrote:
> Under normal usage, the virtual interfaces do not call can_setup(),
> unless if trigger by a call to can_link_ops->setup().
> 
> Patch [1] did not consider this scenario resulting in an out of bound
> read in can_setup() when calling can_link_ops->setup() as reported by
> syzbot ci in [2].
> 
> Replacing netdev_priv() by safe_candev_priv() may look like a
> potential solution at first glance but is not: can_setup() is used as
> a callback function in alloc_netdev_mqs(). At the moment this callback
> is called, priv is not yet fully setup and thus, safe_candev_priv()
> would fail on physical interfaces. In other words, safe_candev_priv()
> is solving the problem for virtual interfaces, but adding another
> issue for physical interfaces.
> 
> Remove the call to can_set_default_mtu() in can_setup(). Instead,
> manually set the MTU the default CAN MTU. This decorrelates the two
> functions, effectively removing the conflict.
> 
> [1] can: populate the minimum and maximum MTU values
> Link: https://lore.kernel.org/linux-can/20250923-can-fix-mtu-v3-3-581bde113f52@kernel.org/
> 
> [2] https://lore.kernel.org/linux-can/68d3e6ce.a70a0220.4f78.0028.GAE@google.com/
> 
> Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
> ---
> @Marc, please squash in
> 
>   [PATCH net-next 27/48] can: populate the minimum and maximum MTU values

I've not changed the commit message of "can: populate the minimum and
maximum MTU values", just added the note that I've squashed this fixup
patch.

I've created a new tag: linux-can-next-for-6.18-20250924

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

^ permalink raw reply	[flat|nested] 9+ messages in thread

* Re: [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu()
  2025-09-24 15:13     ` Marc Kleine-Budde
@ 2025-09-24 15:21       ` Vincent Mailhol
  0 siblings, 0 replies; 9+ messages in thread
From: Vincent Mailhol @ 2025-09-24 15:21 UTC (permalink / raw)
  To: Marc Kleine-Budde
  Cc: Oliver Hartkopp, syzbot, syzkaller-bugs, syzbot ci, biju.das.jz,
	davem, geert, kernel, kuba, linux-can, netdev, stefan.maetje,
	stephane.grosjean, zhao.xichao

On 25/09/2025 at 00:13, Marc Kleine-Budde wrote:
> On 24.09.2025 23:35:44, Vincent Mailhol wrote:
>> Under normal usage, the virtual interfaces do not call can_setup(),
>> unless if trigger by a call to can_link_ops->setup().
>>
>> Patch [1] did not consider this scenario resulting in an out of bound
>> read in can_setup() when calling can_link_ops->setup() as reported by
>> syzbot ci in [2].
>>
>> Replacing netdev_priv() by safe_candev_priv() may look like a
>> potential solution at first glance but is not: can_setup() is used as
>> a callback function in alloc_netdev_mqs(). At the moment this callback
>> is called, priv is not yet fully setup and thus, safe_candev_priv()
>> would fail on physical interfaces. In other words, safe_candev_priv()
>> is solving the problem for virtual interfaces, but adding another
>> issue for physical interfaces.
>>
>> Remove the call to can_set_default_mtu() in can_setup(). Instead,
>> manually set the MTU the default CAN MTU. This decorrelates the two
>> functions, effectively removing the conflict.
>>
>> [1] can: populate the minimum and maximum MTU values
>> Link: https://lore.kernel.org/linux-can/20250923-can-fix-mtu-v3-3-581bde113f52@kernel.org/
>>
>> [2] https://lore.kernel.org/linux-can/68d3e6ce.a70a0220.4f78.0028.GAE@google.com/
>>
>> Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
>> ---
>> @Marc, please squash in
>>
>>   [PATCH net-next 27/48] can: populate the minimum and maximum MTU values
> 
> I've not changed the commit message of "can: populate the minimum and
> maximum MTU values", just added the note that I've squashed this fixup
> patch.

Ack. That was my intent as well. The description remains accurate. I just wrote
the patch description to keep a record of that last minute change ;)

I saw that you just added a link to the fix at the bottom, this is all we need!

> I've created a new tag: linux-can-next-for-6.18-20250924

Thanks!


Yours sincerely,
Vincent Mailhol


^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2025-09-24 15:21 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <20250924082104.595459-1-mkl@pengutronix.de>
2025-09-24 12:40 ` [syzbot ci] Re: pull-request: can-next 2025-09-24 syzbot ci
2025-09-24 13:18   ` Oliver Hartkopp
2025-09-24 13:31     ` Vincent Mailhol
2025-09-24 13:38       ` Marc Kleine-Budde
2025-09-24 13:38       ` Oliver Hartkopp
2025-09-24 14:14         ` Vincent Mailhol
2025-09-24 14:35   ` [PATCH] can: dev: fix out-of-bound read in can_set_default_mtu() Vincent Mailhol
2025-09-24 15:13     ` Marc Kleine-Budde
2025-09-24 15:21       ` Vincent Mailhol

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox