Re: [PATCH] can: peak_usb: validate response and receive record extents

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] OOB Read/Write due to unvalidated DLC in CAN frame parsing.
--

commit 3a2ad6057d438a3e936d788c2a9ec4229e3c427c
Author: Pengpeng Hou <pengpeng@iscas.ac.cn>
can: peak_usb: validate response and receive record extents

This commit adds validation to ensure that both record headers and complete
declared records are present in the response and receive paths before
processing them. This prevents out-of-bounds access when parsing USB message
buffers.

> diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
> index b6be8c19e537f..aaa5f4f7db191 100644
> --- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
> +++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c

[ ... ]

> @@ -727,7 +740,14 @@ static int pcan_usb_pro_decode_buf(struct peak_usb_device *dev, struct urb *urb)
>  	msg_end = urb->transfer_buffer + urb->actual_length;
>  	rec_cnt = le16_to_cpu(*usb_msg.u.rec_cnt_rd);
>  	for (; rec_cnt > 0; rec_cnt--) {
> -		union pcan_usb_pro_rec *pr = (union pcan_usb_pro_rec *)rec_ptr;
> +		union pcan_usb_pro_rec *pr;
> +
> +		if (rec_ptr >= msg_end) {
> +			err = -EBADMSG;
> +			break;
> +		}
> +
> +		pr = (union pcan_usb_pro_rec *)rec_ptr;

[Severity: High]
This is a pre-existing issue, but there appears to be an out-of-bounds read
and write in how these records are processed later in
pcan_usb_pro_handle_canmsg().

When handling a CAN message record from an untrusted USB device:

drivers/net/can/usb/peak_usb/pcan_usb_pro.c:pcan_usb_pro_handle_canmsg() {
    ...
    can_frame->len = rx->len & 0x0f;
    ...
    } else {
        memcpy(can_frame->data, rx->data, can_frame->len);
    ...
}

If the device sends a message where rx->len & 0x0f is greater than 8, can
this result in an out-of-bounds write since can_frame->data is exactly 8
bytes long?

Could this also pass a malformed frame to userspace with a length greater
than 8, violating the classic CAN API contract?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260830135942.19449-1-pengpeng@iscas.ac.cn?part=1