can: af_can: fix NULL pointer dereference in can_rx_register()

In the Linux kernel, the following vulnerability has been resolved:

can: af_can: fix NULL pointer dereference in can_rx_register()

It causes NULL pointer dereference when testing as following:

(a) use syscall(__NR_socket, 0x10ul, 3ul, 0) to create netlink socket.

(b) use syscall(__NR_sendmsg, ...) to create bond link device and vxcan

link device, and bind vxcan device to bond device (can also use

ifenslave command to bind vxcan device to bond device).

(c) use syscall(__NR_socket, 0x1dul, 3ul, 1) to create CAN socket.

(d) use syscall(__NR_bind, ...) to bind the bond device to CAN socket.

The bond device invokes the can-raw protocol registration interface to

receive CAN packets. However, ml_priv is not allocated to the dev,

dev_rcv_lists is assigned to NULL in can_rx_register(). In this case,

it will occur the NULL pointer dereference issue.

The following is the stack information:

BUG: kernel NULL pointer dereference, address: 0000000000000008

PGD 122a4067 P4D 122a4067 PUD 1223c067 PMD 0

Oops: 0000 [#1] PREEMPT SMP

RIP: 0010:can_rx_register+0x12d/0x1e0

Call Trace:

<TASK>

raw_enable_filters+0x8d/0x120

raw_enable_allfilters+0x3b/0x130

raw_bind+0x118/0x4f0

__sys_bind+0x163/0x1a0

__x64_sys_bind+0x1e/0x30

do_syscall_64+0x35/0x80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

</TASK>