Re: [PATCH] bonding: refuse to enslave CAN devices

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Tue, 26 May 2026 21:33:19 +0200 you wrote:
> syzbot reported a kernel paging request crash in
> can_rx_unregister() inside net/can/af_can.c. The crash occurs
> because a virtual CAN device (vxcan) is being enslaved to a
> bonding master.
> 
> During the enslavement process, the bonding driver mutates
> and modifies the network device states to fit an Ethernet-like
> aggregation model. However, CAN devices operate on a completely
> different Layer 2 architecture, relying on the CAN mid-layer
> private data structure (can_ml_priv) instead of standard
> Ethernet structures. Since bonding does not initialize or
> maintain these CAN structures, subsequent operations on the
> half-enslaved interface (such as closing associated sockets
> via isotp_release) lead to a null-pointer dereference when
> accessing the CAN receiver lists.
> 
> [...]

Here is the summary with links:
  - bonding: refuse to enslave CAN devices
    https://git.kernel.org/netdev/net/c/8ba68464e478

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html