From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585692; b=Fbs++6X0y0vvo4wXVZ89aoPopGuV6mtvw94xUh4a9hoHzjkLMTlyMkvUEFgrhyzBnyvW bkhfMZrVEhQEOV/JCP/UNp5FoQAaKdVSlQgODbcve39Gz7CMKo7dIrVnFwEoRNAczmr7F qDNWmvFXz87VJDDuVuGb7/8Bq8glBX9E9B4bvt0VhV5Xb3bfe14pIbVGm4YWqqVbtamsl STVnQbCJyqyr+ulossACy12sux2rcwXLupK3PSJ22hxGtFh73TPFmHrbXH/vnoDpt51G9 hb7LQkHhH6dA7DDIeKbxKFkvSNhfZpAnAUfUPjXdfNjdZaaO/vY5BiE6xUcSYXyCiZA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585692; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=j0yqgxmQHo+1UqHSg8z1w4y7rbLGZN16c0IdxRGTEIY=; b=XVDkhaGJXnfRy8TKi2xZojldt7GIwAeABMeiD5HNtLzU27lZTca1JqE0/HDZ4zQdNqWC 6F4bhXSw1/XuveMG1Wxsc0XrCv+behHVlzFhbmI9DeQAY5iQ5fb1a3KQt3+NJKSGF3W5h J/d91C4SrFpeiqGZJBPD9qS7vfjD8672d0e9nvBS4zPG9/bSRJirEhBP8z9HUxBKOEyY6 UZ5VDO6IZfRofe2XZDYurTw/2gSFTcNaf5MzYsIQu1+TpNNiFZaOWGt8KO4/AxmvzYTd9 f9a+oFWcsuS/rYbh2k3+56kKqqDRnIXpOzivoM1sLIbLIr4tyBER3M/zLV3EH5dgMnQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JMQaGV5u; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEB6960744EC; Fri, 13 Nov 2026 16:01:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JMQaGV5u Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A73D1F000C4; Fri, 13 Nov 2026 16:01:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585692; bh=j0yqgxmQHo+1UqHSg8z1w4y7rbLGZN16c0IdxRGTEIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JMQaGV5uzxQ1k2uIeHmEca/Jb0VG958pVNs1O9uo/UlU4ggZfy0O/iyXbNXhmYT5C sbB6BUcp7lsUDnI4ycVK/ufML+rbytevxx73VDtjYfIgfv4kT/EfpgmYOQt9tvKVIA 7+5uuSMPsQkZYX4P1CIYeBZJ4nwgCNcJCCEheE/c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Liu Changjie , =?UTF-8?q?St=C3=A9phane=20Grosjean?= , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 7.3 301/507] can: peak_usb: pcan_usb_fd_decode_buf(): accept short uCAN end-of-list records Date: Fri, 13 Nov 2026 10:50:05 -0500 Message-ID: <20261113153805.442406300@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Liu Changjie [ Upstream commit 2d4c272e816a5b784f1fc7899256f8826df34edb ] A PCAN-USB FD v2 running firmware 3.2.0 sends a 16-byte status record followed by a four-byte zero-size end marker. Since commit 93fcab2c6968 ("can: peak_usb: validate uCAN receive record lengths") these transfers cause repeated receive-buffer dumps while the interface is up. This has been observed on Linux 7.2.11-arch1-1 with matching kernel headers: - Classic CAN, 500 kbit/s: 25 decoder errors in 5 s before the fix; none in 15 s after. - CAN FD, 500 kbit/s nominal and 2 Mbit/s data: 26 decoder errors in 5 s before the fix; none in 60 s after. - Three additional down/up cycles: no decoder errors. pcan_usb_fd_decode_buf() requires a complete 12-byte struct pucan_msg before checking the size field, so it rejects the end marker with -EBADMSG. Check that the size field is present before testing for an end marker. Require the full header for nonzero-size records and keep the remaining record and payload length checks. This patch was created with LLM assistance. Fixes: 93fcab2c6968 ("can: peak_usb: validate uCAN receive record lengths") Signed-off-by: Liu Changjie Reviewed-by: Stéphane Grosjean Link: https://patch.msgid.link/CH5PR19MB997156AB3BE253C3BE445223B0AC992@CH5PR19MB997156.namprd19.prod.outlook.com Cc: stable@vger.kernel.org [mkl: copy additional info to commit message] [mkl: convert Assisted-by: tag to prose] Signed-off-by: Marc Kleine-Budde --- Built and tested the original and patched peak_usb modules on Arch Linux 7.2.11-arch1-1 with matching kernel headers. - Classic CAN, 500 kbit/s: 25 decoder errors in 5 s before the fix; none in 15 s after. - CAN FD, 500 kbit/s nominal and 2 Mbit/s data: 26 decoder errors in 5 s before the fix; none in 60 s after. - Three additional down/up cycles: no decoder errors. USB captures during the patched tests contained 406 packets with short end markers. Neither receive-buffer dump recurred. The CAN bus was disconnected; external TX/RX was not tested. One startup "can_change_state: oops, state did not change" message and an RX dropped count reaching 2 were observed during the patched tests. Their causes remain undetermined. Signed-off-by: Sasha Levin --- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c index 0d46f4ce5dca7..39f0740421c36 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c @@ -755,7 +755,7 @@ static int pcan_usb_fd_decode_buf(struct peak_usb_device *dev, struct urb *urb) u16 rx_msg_type, rx_msg_size; size_t rx_msg_min_size; - if (msg_end - msg_ptr < sizeof(*rx_msg)) { + if (msg_end - msg_ptr < sizeof(rx_msg->size)) { err = -EBADMSG; break; } @@ -766,6 +766,11 @@ static int pcan_usb_fd_decode_buf(struct peak_usb_device *dev, struct urb *urb) break; } + if (msg_end - msg_ptr < sizeof(*rx_msg)) { + err = -EBADMSG; + break; + } + rx_msg_size = le16_to_cpu(rx_msg->size); rx_msg_type = le16_to_cpu(rx_msg->type); -- 2.53.0