]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
authorMarc Kleine-Budde <mkl@pengutronix.de>
Tue, 15 Jul 2025 20:35:46 +0000 (22:35 +0200)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Tue, 22 Jul 2025 10:55:13 +0000 (12:55 +0200)
commitc1f3f9797c1f44a762e6f5f72520b2e520537b52
treeccf5826e59d9192276e1d7cbc3e80e5cdcd5bb06
parentb03f15c0192b184078206760c839054ae6eb4eaa
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode

Andrei Lalaev reported a NULL pointer deref when a CAN device is
restarted from Bus Off and the driver does not implement the struct
can_priv::do_set_mode callback.

There are 2 code path that call struct can_priv::do_set_mode:
- directly by a manual restart from the user space, via
  can_changelink()
- delayed automatic restart after bus off (deactivated by default)

To prevent the NULL pointer deference, refuse a manual restart or
configure the automatic restart delay in can_changelink() and report
the error via extack to user space.

As an additional safety measure let can_restart() return an error if
can_priv::do_set_mode is not set instead of dereferencing it
unchecked.

Reported-by: Andrei Lalaev <andrey.lalaev@gmail.com>
Closes: https://lore.kernel.org/all/20250714175520.307467-1-andrey.lalaev@gmail.com
Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Link: https://patch.msgid.link/20250718-fix-nullptr-deref-do_set_mode-v1-1-0b520097bb96@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
drivers/net/can/dev/dev.c
drivers/net/can/dev/netlink.c