Re: [PATCH can-next v6 2/6] can: gs_usb: gs_can_start_xmit(): don't leak uninitialized memory over USB

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] can: gs_usb: inaccurate Fixes: trailer in commit message
--

commit ad35ba4588d5d85da58395d08e3738d74f314193
Author: Marc Kleine-Budde <mkl@pengutronix.de>

> can: gs_usb: gs_can_start_xmit(): don't leak uninitialized memory over USB
>
> The driver allocates the transmission buffer using kmalloc(), which means
> the memory remains uninitialized. Then various headers are filled and, but
> only the actual CAN frame data payload (of length cfd->len or cf->len) is
> copied into the buffer, leaving the remaining buffer uninitialized.
>
> Fix this information leak, allocate the buffer with kzalloc().
>
> Closes: https://sashiko.dev/#/bug/linux-0a8c0e8a-c623-426a-8db3-f55111f6cd84
> Fixes: 26949ac935e3 ("can: gs_usb: add CAN-FD support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

[Severity: Low]
Should the Fixes: tag point to d08e973a77d1 ("can: gs_usb: Added support
for the GS_USB CAN devices") instead of 26949ac935e3 ("can: gs_usb: add
CAN-FD support")?

Leaking uninitialized trailing bytes over USB when cf->len < 8 has been
present since d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN
devices"), which allocated hf via usb_alloc_coherent() without __GFP_ZERO
and copied only cf->can_dlc bytes into the 8-byte hf->data array.  The
kmalloc() call modified here was later introduced in 62f102c0d156 ("can:
gs_usb: remove dma allocations").

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-gs_usb-fixes-v6-0-0c039e1bfd74@pengutronix.de?part=2