mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 11:03:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

Browse Source 
The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.

Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.

Fixes: 080f40a6fa ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260722042221.44066-1-pengpeng@iscas.ac.cn
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
This commit is contained in:
Pengpeng Hou
2026-07-22 12:22:21 +08:00
committed by Marc Kleine-Budde
parent 941eaf9a6d
commit 0293dd153f
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
View File

@@ -691,13 +691,22 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,
continue;
}
if (pos + tmp->len > actual_len) {
if (tmp->len < CMD_HEADER_LEN ||
tmp->len > actual_len - pos) {
dev_err_ratelimited(&dev->intf->dev,
"Format error\n");
break;
}
if (tmp->id == id) {
if (tmp->len > sizeof(*cmd)) {
dev_err_ratelimited(&dev->intf->dev,
"Received command %u too large (%u)\n",
tmp->id, tmp->len);
err = -EIO;
goto end;
}
memcpy(cmd, tmp, tmp->len);
goto end;
}
@@ -1737,7 +1746,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev,
continue;
}
if (pos + cmd->len > len) {
if (cmd->len < CMD_HEADER_LEN || cmd->len > len - pos) {
dev_err_ratelimited(&dev->intf->dev, "Format error\n");
break;
}