From: Joas Antonio dos Santos kvaser_usb_hydra_cmd_size() returns the length field supplied by the device for extended commands. Both command parsers advance through the received buffer by that length: kvaser_usb_hydra_wait_cmd() pos += cmd_len; kvaser_usb_hydra_read_bulk_callback() pos += cmd_len; Neither checks that the length is non-zero. A device that sends an extended command (cmd_no == CMD_EXTENDED) with a length of zero keeps pos unchanged, so the loop never terminates. In kvaser_usb_hydra_read_bulk_callback() this happens in the URB completion handler, which also calls kvaser_usb_hydra_handle_cmd() on the same command in every iteration, and locks up the CPU. In kvaser_usb_hydra_wait_cmd() the loop spins in process context without ever reaching the timeout check. A command can never be shorter than its header, so treat a shorter length as a format error in both parsers. A similar infinite loop in the leaf command parsers was fixed in commit 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in command parsers"). Found by LLM-assisted source review. Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") Cc: stable@vger.kernel.org Signed-off-by: Joas Antonio dos Santos --- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c index 687911d764de..92bfdcb04b01 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c @@ -676,7 +676,8 @@ static int kvaser_usb_hydra_wait_cmd(const struct kvaser_usb *dev, u8 cmd_no, tmp_cmd = buf + pos; cmd_len = kvaser_usb_hydra_cmd_size(tmp_cmd); - if (pos + cmd_len > actual_len) { + if (cmd_len < sizeof(struct kvaser_cmd_header) || + pos + cmd_len > actual_len) { dev_err_ratelimited(&dev->intf->dev, "Format error\n"); break; @@ -2156,6 +2157,11 @@ static void kvaser_usb_hydra_read_bulk_callback(struct kvaser_usb *dev, cmd_len = kvaser_usb_hydra_cmd_size(cmd); + if (cmd_len < sizeof(struct kvaser_cmd_header)) { + dev_err(&dev->intf->dev, "Format error\n"); + return; + } + if (pos + cmd_len > len) { /* We got first part of a command */ int leftover_bytes; -- 2.43.0