mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Stéphane Grosjean" <stephane.grosjean@free.fr>
To: Marc Kleine-Budde <mkl@pengutronix.de>
Cc: "Vincent Mailhol" <mailhol@kernel.org>,
	linux-can@vger.kernel.org, "Pengpeng Hou" <pengpeng@iscas.ac.cn>,
	linux-kernel@vger.kernel.org,
	"Stéphane Grosjean" <s.grosjean@peak-system.fr>,
	"Liu Changjie" <liucj1228@outlook.com>
Subject: Re: [PATCH net] can: peak_usb: accept short uCAN end-of-list records
Date: Wed, 21 Oct 2026 12:20:29 +0200 (CEST)	[thread overview]
Message-ID: <942111184.1248111675.1792578029862.JavaMail.root@zimbra65-e11.priv.proxad.net> (raw)
In-Reply-To: <20261021-hospitable-gentle-sheep-a15164-mkl@pengutronix.de>

Hi Marc,

On 19.10.2026 00:46:34, Liu Changjie wrote:
> A PCAN-USB FD v2 running firmware 3.2.0 sends a 16-byte status
> record followed by a four-byte zero-size end marker. These transfers
> cause repeated receive-buffer dumps while the interface is up.
>
> pcan_usb_fd_decode_buf() requires a complete 12-byte struct pucan_msg
> before checking the size field, so it rejects the end marker with
> -EBADMSG.

Right: the firmware may terminate a list of records with a short null
record, and it doesn't need to be a full struct pucan_msg. Only its size
field matters.

The patch keeps all the record length checks added by 93fcab2c6968 and
only accepts the end marker earlier, so:

Reviewed-by: Stéphane Grosjean <s.grosjean@peak-system.fr>

Marc, since 93fcab2c6968 has been backported to the 6.6, 6.12 and 7.1
stable trees, could you add "Cc: stable@vger.kernel.org" when applying?

Thanks,

Stéphane

----- Mail original -----
> Stéphane,
> 
> can you have a look at this?
> 
> On 19.10.2026 00:46:34, Liu Changjie wrote:
> > A PCAN-USB FD v2 running firmware 3.2.0 sends a 16-byte status
> > record followed by a four-byte zero-size end marker. These
> > transfers
> > cause repeated receive-buffer dumps while the interface is up.
> >
> > pcan_usb_fd_decode_buf() requires a complete 12-byte struct
> > pucan_msg
> > before checking the size field, so it rejects the end marker with
> > -EBADMSG.
> >
> > Check that the size field is present before testing for an end
> > marker.
> > Require the full header for nonzero-size records and keep the
> > remaining
> > record and payload length checks.
> >
> > Fixes: 93fcab2c6968 ("can: peak_usb: validate uCAN receive record
> > lengths")
> > Assisted-by: LLM
> > Signed-off-by: Liu Changjie <liucj1228@outlook.com>
> 
> Marc
> 
> --
> Pengutronix e.K.                 | Marc Kleine-Budde          |
> Embedded Linux                   | https://www.pengutronix.de |
> Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
> Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |
> 

  reply	other threads:[~2026-10-21 10:20 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-18 16:46 Liu Changjie
2026-10-21  9:13 ` Marc Kleine-Budde
2026-10-21 10:20   ` Stéphane Grosjean [this message]
2026-10-21 14:33     ` Marc Kleine-Budde

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=942111184.1248111675.1792578029862.JavaMail.root@zimbra65-e11.priv.proxad.net \
    --to=stephane.grosjean@free.fr \
    --cc=linux-can@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=liucj1228@outlook.com \
    --cc=mailhol@kernel.org \
    --cc=mkl@pengutronix.de \
    --cc=pengpeng@iscas.ac.cn \
    --cc=s.grosjean@peak-system.fr \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®