Re: [PATCH can-next v6 2/6] can: gs_usb: gs_can_start_xmit(): don't leak uninitialized memory over USB

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found more severe
issue(s) in other patches of this series. This mail is only an FYI, in case
you want to address the nit picks below when you respin.

Low priority / nit picks for your consideration:

- [Low] can: gs_usb: inaccurate Fixes: trailer in commit message

--

> diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
> --- a/drivers/net/can/usb/gs_usb.c
> +++ b/drivers/net/can/usb/gs_usb.c
> @@ -861,7 +861,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
>  	if (!urb)
>  		goto nomem_urb;
>  
> -	hf = kmalloc(dev->hf_size_tx, GFP_ATOMIC);
> +	hf = kzalloc(dev->hf_size_tx, GFP_ATOMIC);
>  	if (!hf)
>  		goto nomem_hf;
>  
>

[Severity: Low]
The Fixes: tag points at 26949ac935e3 ("can: gs_usb: add CAN-FD
support"). As far as I can tell, the leak in gs_can_start_xmit() is
older than the CAN-FD support.

The original driver, d08e973a77d1 ("can: gs_usb: Added support for the
GS_USB CAN devices"), already allocated hf with usb_alloc_coherent()
without __GFP_ZERO. It copied only cf->can_dlc bytes into the 8 byte
hf->data array and then submitted the full sizeof(*hf) buffer. So
whenever the DLC was below 8, the tail of hf->data went out over USB
uninitialized.

The kmalloc() call changed here was added later by 62f102c0d156
("can: gs_usb: remove dma allocations"). That commit kept the same
behaviour.

This patch is tagged for stable. With the tag pointing at the CAN-FD
commit, stable trees that have the classic CAN variant of the leak but
not 26949ac935e3 may never pick up a fix.

Should this be Fixes: d08e973a77d1 instead? The one-liner will not
apply before 62f102c0d156, so older trees would need a separate
backport against usb_alloc_coherent(). Would you rather list both
commits, or add a note for the stable maintainers?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261113-gs_usb-fixes-v6-0-0c039e1bfd74%40pengutronix.de