[PATCH 0/2] can: esd_usb: validate data received from the device

[Joas Antonio dos Santos via B4 Relay <devnull+joasantonio108.gmail.com@kernel.org>]

Two fixes for values that esd_usb takes from the USB device without
checking them.

Patch 1 limits the number of nets reported in the version reply to
ESD_USB_MAX_NETS.  Marc Kleine-Budde asked for this clamp during the
review of the esd_usb cleanup series in August 2025; as far as I can
tell it never landed.

Patch 2 validates the message length in the rx path, so that a zero
length cannot stall the URB completion handler and a message is not
handled before checking that it fits in the received data.

These issues were found with the help of an LLM-based code review tool
(Claude).  I checked the code paths by hand against v7.4-rc3 and
reviewed the fixes myself.  They are build-tested only (W=1, arm64); I
do not have the hardware to test them at runtime.

---
Joas Antonio dos Santos (2):
      can: esd_usb: limit the number of nets reported by the device
      can: esd_usb: validate the message length in the rx path

 drivers/net/can/usb/esd_usb.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)
---
base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
change-id: 20261110-esd-usb-validate-14264b90e5bb

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>