tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message

When looking at the data in a USB urb, the actual_length is the size of
the buffer passed to the driver, not the transfer_buffer_length which is
set by the driver as the max size of the buffer.

When parsing the messages in ems_usb_read_bulk_callback() properly check
the size both at the beginning of parsing the message to make sure it is
big enough for the expected structure, and at the end of the message to
make sure we don't overflow past the end of the buffer for the next
message.

Cc: Vincent Mailhol <mailhol@kernel.org>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: stable@kernel.org
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/2026022316-answering-strainer-a5db@gregkh
Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

authored by

Greg Kroah-Hartman and committed by
Marc Kleine-Budde 38a01c97 968b0982

+6 -1
+6 -1
drivers/net/can/usb/ems_usb.c
··· 445 445 start = CPC_HEADER_SIZE; 446 446 447 447 while (msg_count) { 448 + if (start + CPC_MSG_HEADER_LEN > urb->actual_length) { 449 + netdev_err(netdev, "format error\n"); 450 + break; 451 + } 452 + 448 453 msg = (struct ems_cpc_msg *)&ibuf[start]; 449 454 450 455 switch (msg->type) { ··· 479 474 start += CPC_MSG_HEADER_LEN + msg->length; 480 475 msg_count--; 481 476 482 - if (start > urb->transfer_buffer_length) { 477 + if (start > urb->actual_length) { 483 478 netdev_err(netdev, "format error\n"); 484 479 break; 485 480 }