Re: [PATCH] can: dev: fix missing skb header initialization in init_can_skb

[Oliver Hartkopp]

Hallo Shaunak,

many thanks for your patch. But there's already a fix awaiting upstream:

https://lore.kernel.org/linux-can/20260917123716.63116-1-ndaugoing@xxxxxxxxx/

Best regards,
Oliver

On 18.09.26 17:16, Shaunak Datar wrote:
> __alloc_skb() sets skb->mac_header to (typeof(skb->mac_header))~0U via
> __finalize_skb_around(). skb_reset_mac_len() checks if the value has been
> updated via the skb_mac_header_was_set() and fires
> DEBUG_NET_WARN_ON_ONCE(1) if not.
>
> init_can_skb() previously included three header reset calls:
>
> - skb_reset_mac_header(skb)
> - skb_reset_network_header(skb)
> - skb_reset_transport_header(skb)
>
> Commit 9f10374bb024 ("can: remove private CAN skb headroom
> infrastructure") dropped these calls which leads to the skb->mac_header
> retaining the original value.
>
> Restore the three missing calls in the init_can_skb().
>
> Fixes: 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
> Reported-by: syzbot+1aae11dc8d42ec1a87ec@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=1aae11dc8d42ec1a87ec
> Signed-off-by: Shaunak Datar <shaunakkdatar@xxxxxxxxx>
> ---
>   drivers/net/can/dev/skb.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
> index 95fcdc1026f8..9cbddc1edd41 100644
> --- a/drivers/net/can/dev/skb.c
> +++ b/drivers/net/can/dev/skb.c
> @@ -210,6 +210,9 @@ static void init_can_skb(struct sk_buff *skb)
>   {
>   	skb->pkt_type = PACKET_BROADCAST;
>   	skb->ip_summed = CHECKSUM_UNNECESSARY;
> +	skb_reset_mac_header(skb);
> +	skb_reset_network_header(skb);
> +	skb_reset_transport_header(skb);
>   }
>   
>   struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)