diff options
| author | James Gao <jamesgao5@outlook.com> | 2026-05-20 13:40:03 +0800 |
|---|---|---|
| committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2026-07-29 11:58:25 +0200 |
| commit | 39132f166ca8ce00ae60d8a9068e06a60943cc4b (patch) | |
| tree | 8480d20ca3d7a7f963542bcc135af614206d166f /tools/perf/scripts/python/export-to-sqlite.py | |
| parent | d937bdb244a751fe5967052ea2d64a7b2c476cc0 (diff) | |
can: peak_usb: add bounds check for USB channel index
The channel control index ctrl_idx is derived from rx->len which comes
directly from a device USB payload. The mask 0x0f allows values 0-15, but
the array size of usb_if->dev[] is only 2. Values 2-15 cause heap
out-of-bounds read, eventually causing kernel panic in the IRQ context.
Add bounds checking for ctrl_idx before the array access in both
pcan_usb_pro_handle_canmsg() and pcan_usb_pro_handle_error().
Fixes: d8a199355f8f ("can: usb: PEAK-System Technik PCAN-USB Pro specific part")
Signed-off-by: James Gao <jamesgao5@outlook.com>
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/TYWPR01MB8559DBAAAA6A7F410400329CF0012@TYWPR01MB8559.jpnprd01.prod.outlook.com
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'tools/perf/scripts/python/export-to-sqlite.py')
0 files changed, 0 insertions, 0 deletions