linux-stable-mirror

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00

Files

T

Pengpeng HouandMarc Kleine-Budde 0293dd153f can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.

Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.

Fixes: 080f40a6fa ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260722042221.44066-1-pengpeng@iscas.ac.cn
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

2026-07-29 12:00:00 +02:00

kvaser_usb_core.c

can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak

2026-01-16 20:40:40 +01:00

kvaser_usb_devlink.c

can: kvaser_usb: Add devlink port support

2025-07-25 18:01:22 +02:00

kvaser_usb_hydra.c

can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()

2026-07-29 12:00:00 +02:00

kvaser_usb_leaf.c

can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents