Enslaving a CAN device (e.g. vxcan) to a team master triggers a NULL pointer dereference in can_rx_unregister() inside net/can/af_can.c. During team_port_add(), the code only checks IFF_LOOPBACK but does not reject ARPHRD_CAN devices. After passing this gate, team_dev_type_check_change() calls team_setup_by_port() which sets dev->type = port_dev->type, adopting the CAN type for the team device. However, CAN devices operate on a fundamentally different Layer 2 architecture, relying on the CAN mid-layer private data structure (can_ml_priv) instead of standard Ethernet structures. Since the team driver never initializes can_ml_priv, subsequent CAN subsystem operations -- such as closing an ISOTP socket bound to the team interface via isotp_release() -- reach can_rx_unregister() which dereferences the NULL can_ml_priv, causing a kernel crash. The bonding driver already rejects CAN devices since commit 8ba68464e478 ("bonding: refuse to enslave CAN devices"). Team, as a sibling aggregation path, needs the same protection. Fix this by adding an explicit ARPHRD_CAN check in team_port_add(), directly after the IFF_LOOPBACK guard, consistent with the approach taken in bond_enslave(). Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao --- drivers/net/team/team_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/team/team_core.c b/drivers/net/team/team_core.c index feaa75fbf8fc..38f88a836010 100644 --- a/drivers/net/team/team_core.c +++ b/drivers/net/team/team_core.c @@ -1224,6 +1224,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev, return -EINVAL; } + if (port_dev->type == ARPHRD_CAN) { + NL_SET_ERR_MSG(extack, "CAN device can't be added as a team port"); + netdev_err(dev, "Device %s is CAN device. CAN devices can't be added as a team port\n", + portname); + return -EINVAL; + } + if (netif_is_team_port(port_dev)) { NL_SET_ERR_MSG(extack, "Device is already a port of a team device"); netdev_err(dev, "Device %s is already a port " -- 2.34.1