linux/net/can
Oleksij Rempel 4e096a1886 net: introduce CAN specific pointer in the struct net_device
Since 20dd3850bc ("can: Speed up CAN frame receiption by using
ml_priv") the CAN framework uses per device specific data in the AF_CAN
protocol. For this purpose the struct net_device->ml_priv is used. Later
the ml_priv usage in CAN was extended for other users, one of them being
CAN_J1939.

Later in the kernel ml_priv was converted to an union, used by other
drivers. E.g. the tun driver started storing it's stats pointer.

Since tun devices can claim to be a CAN device, CAN specific protocols
will wrongly interpret this pointer, which will cause system crashes.
Mostly this issue is visible in the CAN_J1939 stack.

To fix this issue, we request a dedicated CAN pointer within the
net_device struct.

Reported-by: syzbot+5138c4dd15a0401bec7b@syzkaller.appspotmail.com
Fixes: 20dd3850bc ("can: Speed up CAN frame receiption by using ml_priv")
Fixes: ffd956eef6 ("can: introduce CAN midlayer private and allocate it automatically")
Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol")
Fixes: 497a5757ce ("tun: switch to net core provided statistics counters")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://lore.kernel.org/r/20210223070127.4538-1-o.rempel@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-24 14:32:15 -08:00
..
j1939 net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
af_can.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
af_can.h can: introduce CAN midlayer private and allocate it automatically 2019-09-04 13:29:14 +02:00
bcm.c can: remove obsolete version strings 2020-10-12 10:06:39 +02:00
gw.c can: gw: fix typo 2021-01-27 10:01:46 +01:00
isotp.c can: isotp: isotp_getname(): fix kernel information leak 2021-01-13 22:15:13 +01:00
Kconfig net: remove redundant 'depends on NET' 2021-01-27 17:04:12 -08:00
Makefile can: add ISO 15765-2:2016 transport protocol 2020-10-07 23:18:33 +02:00
proc.c net: introduce CAN specific pointer in the struct net_device 2021-02-24 14:32:15 -08:00
raw.c can: raw: return -ERANGE when filterset does not fit into user space buffer 2021-01-06 15:15:41 +01:00