Re: [PATCH] can: ucan: Fix infinite loop from zero-length messages

[Marc Kleine-Budde]

On 23.02.2026 17:30:20, Greg Kroah-Hartman wrote:
> If a broken ucan device gets a message with the message length field set
> to 0, then the driver will loop for forever in
> ucan_read_bulk_callback(), hanging the system.  If the length is 0, just
> skip the message and go on to the next one.
>
> This has been fixed in the kvaser_usb driver in the past in commit
> 0c73772cd2b8 ("can: kvaser_usb: leaf: Fix potential infinite loop in
> command parsers"), so there must be some broken devices out there like
> this somewhere.
>
> Cc: Marc Kleine-Budde <mkl@xxxxxxxxxxxxxx>
> Cc: Vincent Mailhol <mailhol@xxxxxxxxxx>
> Cc: stable <stable@xxxxxxxxxx>
> Assisted-by: gkh_clanker_2000
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

Applied to linux-can, with preferred stable format.

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Attachment: signature.asc
Description: PGP signature