can: af_can: can_rx_unregister(): remove WARN() statement from list operation sanity...
authorOliver Hartkopp <socketcan@hartkopp.net>
Thu, 26 Nov 2020 19:21:40 +0000 (20:21 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Dec 2020 12:22:11 +0000 (13:22 +0100)
commit1b1e68927e09bad4a29624e494fd7a73c1b7719b
tree776affcab1d247ecd66e2c15b87f6260ec1b4f60
parentbc6ca732f4a4dce79abd0fdeb81fc5c20e01fd0a
can: af_can: can_rx_unregister(): remove WARN() statement from list operation sanity check

commit d73ff9b7c4eacaba0fd956d14882bcae970f8307 upstream.

To detect potential bugs in CAN protocol implementations (double removal of
receiver entries) a WARN() statement has been used if no matching list item was
found for removal.

The fault injection issued by syzkaller was able to create a situation where
the closing of a socket runs simultaneously to the notifier call chain for
removing the CAN network device in use.

This case is very unlikely in real life but it doesn't break anything.
Therefore we just replace the WARN() statement with pr_warn() to preserve the
notification for the CAN protocol development.

Reported-by: syzbot+381d06e0c8eaacb8706f@syzkaller.appspotmail.com
Reported-by: syzbot+d0ddd88c9a7432f041e6@syzkaller.appspotmail.com
Reported-by: syzbot+76d62d3b8162883c7d11@syzkaller.appspotmail.com
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://lore.kernel.org/r/20201126192140.14350-1-socketcan@hartkopp.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/can/af_can.c