can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode

In the Linux kernel, the following vulnerability has been resolved:

can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode

Andrei Lalaev reported a NULL pointer deref when a CAN device is

restarted from Bus Off and the driver does not implement the struct

can_priv::do_set_mode callback.

There are 2 code path that call struct can_priv::do_set_mode:

- directly by a manual restart from the user space, via

can_changelink()

- delayed automatic restart after bus off (deactivated by default)

To prevent the NULL pointer deference, refuse a manual restart or

configure the automatic restart delay in can_changelink() and report

the error via extack to user space.

As an additional safety measure let can_restart() return an error if

can_priv::do_set_mode is not set instead of dereferencing it

unchecked.