Re: [BUG] drivers/net: out-of-bounds in pcan_usb_decode_buf()

[Geert Uytterhoeven]

Hi Xiang,

On Mon, 7 Sept 2026 at 00:19, Xiang Mei <xmei5@xxxxxxx> wrote:
> On Sat, Sep 5, 2026 at 7:04 AM Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> wrote:
> > On Fri, 4 Sept 2026 at 23:17, co <co+5e2bcf11e7027510@xxxxxxx> wrote:
> > > We found a bug reachable in:
> > >
> > >     path    drivers/net/can/usb/peak_usb
> > >     crash   out-of-bounds in pcan_usb_decode_buf()
> > >     commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> > >
> > > Config, environment, the sanitizer report and a C reproducer follow.
> > >
> > > == Notes ===============================================================
> > >     If you patch the bug based on our artifacts, a tag would be
> > >     appreciated:
> > >
> > > Reported-by: co+5e2bcf11e7027510@xxxxxxx
> > >
> > >     Everything in this mail is validated by the reproducer below.
> > >
> > >     We also hold an LLM-generated root-cause analysis and a candidate
> > >     patch. The patch passes an A/B test: the same reproducer panics the
> > >     unpatched kernel and runs clean on the patched one. Neither has had
> > >     human review, so both still require validation before you send or
> > >     apply them. Available on:
> > >
> > >         patch.diff  https://bugs.sh/b/5e2bcf11e7027510/patch.diff
> > >         report.md   https://bugs.sh/b/5e2bcf11e7027510/report.md
> > >
> > >     This is an open science project. The code and the full set of PoCs
> > >     are not public at this moment, as we intend to disclose our findings
> > >     in an ethical way.
> > >
> > >     Happy to test patches. Complaints and suggestions about our work
> > >     are welcome at:
> > >
> > >         cedalion@xxxxxxx
> >
> > Please read Documentation/process/submitting-patches.rst, especially
> > https://elixir.bootlin.com/linux/v7.2.2/source/Documentation/process/submitting-patches.rst#L928
>
> I checked the document and the related files, and I apologize for our
> mistake. This email should not have been sent to you, as our system
> failed to identify the correct maintainers for this submodule.

Thank you!

> We have fixed the issue. Thank you for bringing it to our attention.
> If you meant other issues, please let us know.

There are other issues, like not sending patches inline, so they
cannot be reviewed easily.
Thanks again!

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds