Re: [PATCH] team: reject ARPHRD_CAN devices in team_port_add
flat view
From: Oliver Hartkopp <socketcan@hartkopp.net>
Date: 2026-07-28 07:11:49
Also in:
lkml
On 23.07.26 06:00, Jiale Yao wrote:
Enslaving a CAN device (e.g. vxcan) to a team master triggers a
NULL pointer dereference in can_rx_unregister() inside
net/can/af_can.c.
During team_port_add(), the code only checks IFF_LOOPBACK but
does not reject ARPHRD_CAN devices. After passing this gate,
team_dev_type_check_change() calls team_setup_by_port() which
sets dev->type = port_dev->type, adopting the CAN type for the
team device. However, CAN devices operate on a fundamentally
different Layer 2 architecture, relying on the CAN mid-layer
private data structure (can_ml_priv) instead of standard
Ethernet structures. Since the team driver never initializes
can_ml_priv, subsequent CAN subsystem operations -- such as
closing an ISOTP socket bound to the team interface via
isotp_release() -- reach can_rx_unregister() which dereferences
the NULL can_ml_priv, causing a kernel crash.
The bonding driver already rejects CAN devices since commit
8ba68464e478 ("bonding: refuse to enslave CAN devices").
Team, as a sibling aggregation path, needs the same protection.
Fix this by adding an explicit ARPHRD_CAN check in
team_port_add(), directly after the IFF_LOOPBACK guard,
consistent with the approach taken in bond_enslave().
Fixes: 1d76efe1577b ("team: add support for non-ethernet devices")
Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <redacted>Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> I did not know that the team driver had the same approach. Thanks for catching this! Best regards, Oliver
quoted hunk ↗ jump to hunk
--- drivers/net/team/team_core.c | 7 +++++++ 1 file changed, 7 insertions(+)diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c index feaa75fbf8fc..38f88a836010 100644 --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c@@ -1224,6 +1224,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev, return -EINVAL; } + if (port_dev->type == ARPHRD_CAN) { + NL_SET_ERR_MSG(extack, "CAN device can't be added as a team port"); + netdev_err(dev, "Device %s is CAN device. CAN devices can't be added as a team port\n", + portname); + return -EINVAL; + } + if (netif_is_team_port(port_dev)) { NL_SET_ERR_MSG(extack, "Device is already a port of a team device"); netdev_err(dev, "Device %s is already a port "