github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-20 09:40:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
185a4caeec
linux/drivers/net/can/usb/kvaser_usb
History
Pengpeng Hou 0293dd153f can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents 
The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.

Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.

Fixes: 080f40a6fa ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260722042221.44066-1-pengpeng@iscas.ac.cn
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2026-07-29 12:00:00 +02:00
..
kvaser_usb_core.c can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak 2026-01-16 20:40:40 +01:00
kvaser_usb_devlink.c can: kvaser_usb: Add devlink port support 2025-07-25 18:01:22 +02:00
kvaser_usb_hydra.c can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() 2026-07-29 12:00:00 +02:00
kvaser_usb_leaf.c can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents 2026-07-29 12:00:00 +02:00
kvaser_usb.h can: kvaser_usb: Add devlink port support 2025-07-25 18:01:22 +02:00
Makefile can: kvaser_usb: Add devlink support 2025-07-25 18:01:21 +02:00