can: add missing initialisations in CAN related skbuffs

hartkopp · marckleinebudde · commit 969439016d2c · 2015-03-09T10:22:24.000+01:00
When accessing CAN network interfaces with AF_PACKET sockets e.g. by dhclient
this can lead to a skb_under_panic due to missing skb initialisations.

Add the missing initialisations at the CAN skbuff creation times on driver
level (rx path) and in the network layer (tx path).

Reported-by: Austin Schuh &lt;austin@peloton-tech.com&gt;
Reported-by: Daniel Steer &lt;daniel.steer@mclaren.com&gt;
Signed-off-by: Oliver Hartkopp &lt;socketcan@hartkopp.net&gt;
Cc: linux-stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Marc Kleine-Budde &lt;mkl@pengutronix.de&gt;
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
@@ -579,6 +579,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
+
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 
@@ -603,6 +607,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
+
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 
diff --git a/net/can/af_can.c b/net/can/af_can.c
@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
 		goto inval_skb;
 	}
 
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+	skb_reset_mac_header(skb);
 	skb_reset_network_header(skb);
 	skb_reset_transport_header(skb);
 

Original file line number	Diff line number	Diff line change
`@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)`
`259`	`259`	`goto inval_skb;`
`260`	`260`	`}`
`261`	`261`
	`262`	`+ skb->ip_summed = CHECKSUM_UNNECESSARY;`
	`263`	`+`
	`264`	`+ skb_reset_mac_header(skb);`
`262`	`265`	`skb_reset_network_header(skb);`
`263`	`266`	`skb_reset_transport_header(skb);`
`264`	`267`