From: Joas Antonio dos Santos The number of tx contexts is taken from the max_outstanding_tx field of the software info reply sent by the device. The leaf driver uses the value as is and the hydra driver only limits it to KVASER_USB_MAX_TX_URBS, so a device can report zero. dev->max_tx_urbs is then used as a divisor when a tx acknowledge is received: kvaser_usb_leaf_tx_acknowledge() context = &priv->tx_contexts[tid % dev->max_tx_urbs]; kvaser_usb_hydra_tx_acknowledge() context = &priv->tx_contexts[transid % dev->max_tx_urbs]; With max_tx_urbs == 0 a tx acknowledge sent by the device while the interface is up is a division by zero in the URB completion handler on architectures that trap on it. On architectures that do not trap, the index is not reduced at all and tx_contexts[], which was allocated with zero elements, is accessed out of bounds. A device that cannot accept any outstanding tx frame is not usable, so fail the probe when it reports zero. Found by LLM-assisted source review. Fixes: 082d70b6142f ("can: kvaser_usb: Comply with firmware max tx URBs value") Cc: stable@vger.kernel.org Signed-off-by: Joas Antonio dos Santos --- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c index d0a2a2a33c1c..a915e529290b 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -977,6 +977,12 @@ static int kvaser_usb_probe(struct usb_interface *intf, goto free_devlink; } + if (!dev->max_tx_urbs) { + dev_err(&intf->dev, "Invalid max outstanding tx (0)\n"); + err = -ENODEV; + goto free_devlink; + } + if (ops->dev_get_software_details) { err = ops->dev_get_software_details(dev); if (err) { -- 2.43.0