Under normal usage, the virtual interfaces do not call can_setup(), unless if trigger by a call to can_link_ops->setup(). Patch [1] did not consider this scenario resulting in an out of bound read in can_setup() when calling can_link_ops->setup() as reported by syzbot ci in [2]. Replacing netdev_priv() by safe_candev_priv() may look like a potential solution at first glance but is not: can_setup() is used as a callback function in alloc_netdev_mqs(). At the moment this callback is called, priv is not yet fully setup and thus, safe_candev_priv() would fail on physical interfaces. In other words, safe_candev_priv() is solving the problem for virtual interfaces, but adding another issue for physical interfaces. Remove the call to can_set_default_mtu() in can_setup(). Instead, manually set the MTU the default CAN MTU. This decorrelates the two functions, effectively removing the conflict. [1] can: populate the minimum and maximum MTU values Link: https://lore.kernel.org/linux-can/20250923-can-fix-mtu-v3-3-581bde113f52@kernel.org/ [2] https://lore.kernel.org/linux-can/68d3e6ce.a70a0220.4f78.0028.GAE@google.com/ Signed-off-by: Vincent Mailhol --- @Marc, please squash in [PATCH net-next 27/48] can: populate the minimum and maximum MTU values --- drivers/net/can/dev/dev.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c index e5a82aa77958..15ccedbb3f8d 100644 --- a/drivers/net/can/dev/dev.c +++ b/drivers/net/can/dev/dev.c @@ -272,12 +272,13 @@ EXPORT_SYMBOL_GPL(can_bus_off); void can_setup(struct net_device *dev) { dev->type = ARPHRD_CAN; + dev->mtu = CAN_MTU; + dev->min_mtu = CAN_MTU; + dev->max_mtu = CAN_MTU; dev->hard_header_len = 0; dev->addr_len = 0; dev->tx_queue_len = 10; - can_set_default_mtu(dev); - /* New-style flags. */ dev->flags = IFF_NOARP; dev->features = NETIF_F_HW_CSUM; -- 2.49.1