Oleksij Rempel 4e096a1886 net: introduce CAN specific pointer in the struct net_device ... Since 20dd3850bc ("can: Speed up CAN frame receiption by using ml_priv") the CAN framework uses per device specific data in the AF_CAN protocol. For this purpose the struct net_device->ml_priv is used. Later the ml_priv usage in CAN was extended for other users, one of them being CAN_J1939. Later in the kernel ml_priv was converted to an union, used by other drivers. E.g. the tun driver started storing it's stats pointer. Since tun devices can claim to be a CAN device, CAN specific protocols will wrongly interpret this pointer, which will cause system crashes. Mostly this issue is visible in the CAN_J1939 stack. To fix this issue, we request a dedicated CAN pointer within the net_device struct. Reported-by: syzbot+5138c4dd15a0401bec7b@syzkaller.appspotmail.com Fixes: 20dd3850bc ("can: Speed up CAN frame receiption by using ml_priv") Fixes: ffd956eef6 ("can: introduce CAN midlayer private and allocate it automatically") Fixes: 9d71dd0c70 ("can: add support of SAE J1939 protocol") Fixes: 497a5757ce ("tun: switch to net core provided statistics counters") Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://lore.kernel.org/r/20210223070127.4538-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2021-02-24 14:32:15 -08:00
..
dev	can: remove obsolete get_canfd_dlc() macro	2020-11-20 09:43:30 +01:00
platform	can: mcp251x: get rid of legacy platform data	2019-11-11 21:57:28 +01:00
bittiming.h	can: dev: move bittiming related code into seperate file	2021-01-13 09:42:58 +01:00
can-ml.h	net: introduce CAN specific pointer in the struct net_device	2021-02-24 14:32:15 -08:00
core.h	can: remove obsolete version strings	2020-10-12 10:06:39 +02:00
dev.h	can: dev: export can_get_state_str() function	2021-01-27 10:01:46 +01:00
led.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
length.h	can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer	2021-01-14 08:43:42 +01:00
rx-offload.h	can: dev: can_rx_offload_get_echo_skb(): extend to return can frame length	2021-01-14 08:43:43 +01:00
skb.h	can: dev: can_get_echo_skb(): extend to return can frame length	2021-01-14 08:43:43 +01:00