netdev - [can-next v2 0/5] can: remove private skb headroom infrastructure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260117132824.3649-1-socketcan@hartkopp.net>
Date: Sat, 17 Jan 2026 14:28:19 +0100
From: Oliver Hartkopp <socketcan@...tkopp.net>
To: linux-can@...r.kernel.org,
	Marc Kleine-Budde <mkl@...gutronix.de>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>
Cc: Vincent Mailhol <mailhol@...nel.org>,
	netdev@...r.kernel.org,
	Eric Dumazet <edumazet@...gle.com>,
	Simon Horman <horms@...nel.org>,
	Oleksij Rempel <o.rempel@...gutronix.de>,
	davem@...emloft.net,
	Oliver Hartkopp <socketcan@...tkopp.net>
Subject: [can-next v2 0/5] can: remove private skb headroom infrastructure

CAN bus related skbuffs (ETH_P_CAN/ETH_P_CANFD/ETH_P_CANXL) simply contain
CAN frame structs for CAN CC/FD/XL of skb->len length at skb->data.
Those CAN skbs do not have network/mac/transport headers nor other such
references for encapsulated protocols like ethernet/IP protocols.

To store data for CAN specific use-cases all CAN bus related skbuffs are
created with a 16 byte private skb headroom (struct can_skb_priv).
Using the skb headroom and accessing skb->head for this private data
led to several problems in the past likely due to "The struct can_skb_priv
business is highly unconventional for the networking stack." [1]

This patch set aims to remove the unconventional skb headroom usage for
CAN bus related skbuffs. To store the data for CAN specific use-cases
unused space in CAN skbs is used, namely the inner protocol space for
ethernet/IP encapsulation. The skb->encapsulation flag remains false in
CAN skbs so that the ethernet/IP encapsulation (tunnel) data is tagged as
unused/invalid in the case the skb is accidentally routed to non-CAN
targets (netdev/netlayer).

The patch set reduces the potential interactions with ethernet/IP code and
builds skbs that won't harm the system even if the skb is evaluated or
modified by other networking components. In such an invalid case the CAN
skb is dropped in can_rcv, e.g. if skb->encapsulation was set.

[1] https://lore.kernel.org/linux-can/20260104074222.29e660ac@kernel.org/

V2: - net-next rebase due to net/can/raw.c fix in commit faba5860fcf9
      ("can: raw: instantly reject disabled CAN frames")
    - extend the cover letter to address concerns raised by Jakub Kicinski
      and Paolo Abeni regarding the safety of using the shared space for
      ethernet/IP encapsulation for CAN skbs
    - extend the commit messages in patches 1/2/5
    - Added Tested-by: and Acked-by: tags from Oleksij Rempel and me

Oliver Hartkopp (5):
  can: use skb hash instead of private variable in headroom
  can: move can_iif from private headroom to struct sk_buff
  can: move frame length from private headroom to struct sk_buff
  can: remove private skb headroom infrastructure
  can: gw: use new can_gw_hops variable instead of re-using csum_start

 drivers/net/can/dev/skb.c | 45 ++++++++++++++++-----------------------
 include/linux/can/core.h  |  1 +
 include/linux/can/skb.h   | 33 ----------------------------
 include/linux/skbuff.h    | 27 +++++++++++++++++------
 net/can/af_can.c          | 35 +++++++++++++++++++-----------
 net/can/bcm.c             | 13 ++++-------
 net/can/gw.c              | 25 ++++++----------------
 net/can/isotp.c           | 18 ++++++----------
 net/can/j1939/socket.c    |  7 ++----
 net/can/j1939/transport.c | 13 ++++-------
 net/can/raw.c             | 14 ++++++------
 11 files changed, 92 insertions(+), 139 deletions(-)

-- 
2.47.3