can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents

The wait and bulk receive paths walk variable-length commands from a
USB buffer. A nonzero command shorter than CMD_HEADER_LEN can still be
dispatched, and the wait path copies a matching command into a fixed
caller-owned struct kvaser_cmd using the device-provided length.

Reject nonzero commands that do not contain the fixed header or that
extend beyond the current USB buffer item. In the wait path, also reject
a matching command that exceeds the destination before copying it.

Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260722042221.44066-1-pengpeng@iscas.ac.cn
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
index df737cfc5ea0c0468476a2e0ee7603329d63f9c0..a876c7819b81c074fb1914c4bc6e0d9efb22f0e2 100644 (file)
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
@@ -691,13 +691,22 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,
                                continue;
                        }
 
-                       if (pos + tmp->len > actual_len) {
+                       if (tmp->len < CMD_HEADER_LEN ||
+                           tmp->len > actual_len - pos) {
                                dev_err_ratelimited(&dev->intf->dev,
                                                    "Format error\n");
                                break;
                        }
 
                        if (tmp->id == id) {
+                               if (tmp->len > sizeof(*cmd)) {
+                                       dev_err_ratelimited(&dev->intf->dev,
+                                                           "Received command %u too large (%u)\n",
+                                                           tmp->id, tmp->len);
+                                       err = -EIO;
+                                       goto end;
+                               }
+
                                memcpy(cmd, tmp, tmp->len);
                                goto end;
                        }
@@ -1737,7 +1746,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev,
                        continue;
                }
 
-               if (pos + cmd->len > len) {
+               if (cmd->len < CMD_HEADER_LEN || cmd->len > len - pos) {
                        dev_err_ratelimited(&dev->intf->dev, "Format error\n");
                        break;
                }