Forwarded: [PATCH] can: dev: fix missing skb header initialization in init_can_skb

[syzbot <syzbot+1aae11dc8d42ec1a87ec@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] can: dev: fix missing skb header initialization in init_can_skb
Author: shaunakkdatar@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

__alloc_skb() sets skb->mac_header to (typeof(skb->mac_header))~0U via
__finalize_skb_around(). skb_reset_mac_len() checks if the value has been
updated via the skb_mac_header_was_set() and fires
DEBUG_NET_WARN_ON_ONCE(1) if not.

init_can_skb() previously included three header reset calls:

skb_reset_mac_header(skb)
skb_reset_network_header(skb)
skb_reset_transport_header(skb)

Commit 9f10374bb024 ("can: remove private CAN skb headroom
infrastructure") dropped these calls which leads to the skb->mac_header
retaining the original value.

Restore the three missing calls in the init_can_skb().

Fixes: 9f10374bb024 ("can: remove private CAN skb headroom infrastructure")
Reported-by: syzbot+1aae11dc8d42ec1a87ec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1aae11dc8d42ec1a87ec
Signed-off-by: Shaunak Datar <shaunakkdatar@gmail.com>
---
 drivers/net/can/dev/skb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
index 95fcdc1026f8..9cbddc1edd41 100644
--- a/drivers/net/can/dev/skb.c
+++ b/drivers/net/can/dev/skb.c
@@ -210,6 +210,9 @@ static void init_can_skb(struct sk_buff *skb)
 {
 	skb->pkt_type = PACKET_BROADCAST;
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+	skb_reset_mac_header(skb);
+	skb_reset_network_header(skb);
+	skb_reset_transport_header(skb);
 }
 
 struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
-- 
2.53.0