From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590452; b=fUtLTmSn29YoYWD9fJA0jU72SyfIUqhl3Jfn/Lt8LY65koTj3mhgd3HLgURN5fI0ELCd 4Sevh1j7eieC9tPfv4j51WdmlgQ298fL4NvU6quw3GXS0S40BjFT0FblApRFhEBNaVhWU 509YUPUEv/XWdyX+nCQARq+cwRTDIRyHZ+f3Q5FguSzkHRvtmNJK3UKmhkvED7V2EAb2B RrJxVHdgVMC5kNmD0sk5UBiqml65KMNZ9fiBVw48IUSC4K9NYCdVZTJ5X0vaWjPxDkzs0 qbKcfhmIL4yMruhk0wy08JXXtoJRB4zrAwR6F4y76tYCLOZytqJCIU+DUqqVMSrBUyQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590452; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=798QJ1k5PDO/dLvKpL6eQe6k00bKkZ5KgpgmJO9oWko=; b=TjhjUsthhFwdcoCQV+JEq7oNuEo0QkJcxu/egBgxP5L7/az9ll2Du3xzJZ84TVBay2W0 4t0oRDe/s1ji45EEdC8BL5IILgyowHMdNyW7OfNL4+UBxPj9JbQcpCE6dl9ErZG1xBmVE OwhxAfw543zAMwafIpXiC/bkiaI/V/786HXBKVyfaz9/fG+0av6R0xUJbgt5mDwE7qoT6 grwd4NUPQUQFtBYgxJkpwkiK5rxHlCPd0l8zfaj2oLvB1PiHoDGIdeeDiLpc55LvrV2ui VIc5i/vBYBytOMBdcJbKY08j84kCK2qy0j+fzwcmYYNSb5hY8K9rRvOiX/K+JNimxKw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jWWzoCKZ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B3DEA6070F2B; Fri, 13 Nov 2026 17:20:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jWWzoCKZ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F9C91F000CD; Fri, 13 Nov 2026 17:20:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590452; bh=798QJ1k5PDO/dLvKpL6eQe6k00bKkZ5KgpgmJO9oWko=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jWWzoCKZRpPuFYaPpqL4++FbByAEbDJizZ7/cVnTrbhhLuN/JtqzMy81TNzaVqVrb fhC4pAP2I07/5ZPvfMMfzjafBP80P5stOWw1QtsWNXCq9PXSKTupIK6C1Qqtj6BDeS ubIjSoCpSGiY7NVCOizj+aJ5tkY0FJr/lDPSnJDM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Liu Changjie , =?UTF-8?q?St=C3=A9phane=20Grosjean?= , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 6.18 368/686] can: peak_usb: pcan_usb_fd_decode_buf(): accept short uCAN end-of-list records Date: Fri, 13 Nov 2026 10:48:21 -0500 Message-ID: <20261113153833.391623623@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Liu Changjie [ Upstream commit 2d4c272e816a5b784f1fc7899256f8826df34edb ] A PCAN-USB FD v2 running firmware 3.2.0 sends a 16-byte status record followed by a four-byte zero-size end marker. Since commit 93fcab2c6968 ("can: peak_usb: validate uCAN receive record lengths") these transfers cause repeated receive-buffer dumps while the interface is up. This has been observed on Linux 7.2.11-arch1-1 with matching kernel headers: - Classic CAN, 500 kbit/s: 25 decoder errors in 5 s before the fix; none in 15 s after. - CAN FD, 500 kbit/s nominal and 2 Mbit/s data: 26 decoder errors in 5 s before the fix; none in 60 s after. - Three additional down/up cycles: no decoder errors. pcan_usb_fd_decode_buf() requires a complete 12-byte struct pucan_msg before checking the size field, so it rejects the end marker with -EBADMSG. Check that the size field is present before testing for an end marker. Require the full header for nonzero-size records and keep the remaining record and payload length checks. This patch was created with LLM assistance. Fixes: 93fcab2c6968 ("can: peak_usb: validate uCAN receive record lengths") Signed-off-by: Liu Changjie Reviewed-by: Stéphane Grosjean Link: https://patch.msgid.link/CH5PR19MB997156AB3BE253C3BE445223B0AC992@CH5PR19MB997156.namprd19.prod.outlook.com Cc: stable@vger.kernel.org [mkl: copy additional info to commit message] [mkl: convert Assisted-by: tag to prose] Signed-off-by: Marc Kleine-Budde --- Built and tested the original and patched peak_usb modules on Arch Linux 7.2.11-arch1-1 with matching kernel headers. - Classic CAN, 500 kbit/s: 25 decoder errors in 5 s before the fix; none in 15 s after. - CAN FD, 500 kbit/s nominal and 2 Mbit/s data: 26 decoder errors in 5 s before the fix; none in 60 s after. - Three additional down/up cycles: no decoder errors. USB captures during the patched tests contained 406 packets with short end markers. Neither receive-buffer dump recurred. The CAN bus was disconnected; external TX/RX was not tested. One startup "can_change_state: oops, state did not change" message and an RX dropped count reaching 2 were observed during the patched tests. Their causes remain undetermined. Signed-off-by: Sasha Levin --- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c index f92a3b404ec18..7823b4b52c16a 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c @@ -755,7 +755,7 @@ static int pcan_usb_fd_decode_buf(struct peak_usb_device *dev, struct urb *urb) u16 rx_msg_type, rx_msg_size; size_t rx_msg_min_size; - if (msg_end - msg_ptr < sizeof(*rx_msg)) { + if (msg_end - msg_ptr < sizeof(rx_msg->size)) { err = -EBADMSG; break; } @@ -766,6 +766,11 @@ static int pcan_usb_fd_decode_buf(struct peak_usb_device *dev, struct urb *urb) break; } + if (msg_end - msg_ptr < sizeof(*rx_msg)) { + err = -EBADMSG; + break; + } + rx_msg_size = le16_to_cpu(rx_msg->size); rx_msg_type = le16_to_cpu(rx_msg->type); -- 2.53.0