Re: [BUG] drivers/net: out-of-bounds in pcan_usb_decode_buf()

[Xiang Mei]

On Mon, Sep 7, 2026 at 1:28 AM Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> wrote:
>
> Hi Xiang,
>
> On Mon, 7 Sept 2026 at 00:19, Xiang Mei <xmei5@xxxxxxx> wrote:
> > On Sat, Sep 5, 2026 at 7:04 AM Geert Uytterhoeven <geert@xxxxxxxxxxxxxx> wrote:
> > > On Fri, 4 Sept 2026 at 23:17, co <co+5e2bcf11e7027510@xxxxxxx> wrote:
> > > > We found a bug reachable in:
> > > >
> > > >     path    drivers/net/can/usb/peak_usb
> > > >     crash   out-of-bounds in pcan_usb_decode_buf()
> > > >     commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> > > >
> > > > Config, environment, the sanitizer report and a C reproducer follow.
> > > >
> > > > == Notes ===============================================================
> > > >     If you patch the bug based on our artifacts, a tag would be
> > > >     appreciated:
> > > >
> > > > Reported-by: co+5e2bcf11e7027510@xxxxxxx
> > > >
> > > >     Everything in this mail is validated by the reproducer below.
> > > >
> > > >     We also hold an LLM-generated root-cause analysis and a candidate
> > > >     patch. The patch passes an A/B test: the same reproducer panics the
> > > >     unpatched kernel and runs clean on the patched one. Neither has had
> > > >     human review, so both still require validation before you send or
> > > >     apply them. Available on:
> > > >
> > > >         patch.diff  https://bugs.sh/b/5e2bcf11e7027510/patch.diff
> > > >         report.md   https://bugs.sh/b/5e2bcf11e7027510/report.md
> > > >
> > > >     This is an open science project. The code and the full set of PoCs
> > > >     are not public at this moment, as we intend to disclose our findings
> > > >     in an ethical way.
> > > >
> > > >     Happy to test patches. Complaints and suggestions about our work
> > > >     are welcome at:
> > > >
> > > >         cedalion@xxxxxxx
> > >
> > > Please read Documentation/process/submitting-patches.rst, especially
> > > https://elixir.bootlin.com/linux/v7.2.2/source/Documentation/process/submitting-patches.rst#L928
> >
> > I checked the document and the related files, and I apologize for our
> > mistake. This email should not have been sent to you, as our system
> > failed to identify the correct maintainers for this submodule.
>
> Thank you!
>
> > We have fixed the issue. Thank you for bringing it to our attention.
> > If you meant other issues, please let us know.
>
> There are other issues, like not sending patches inline, so they
> cannot be reviewed easily.
> Thanks again!
>
Thanks for the feedback.

The patch is entirely LLM-generated, and we don't want to “DoS”
maintainers' time by asking them to review LLM-generated patches. We
believe sending LLM-generated patches without human review is
irresponsible. We'll make this clearer in future reports and clarify
that these are bug reports and that the generated patches have
limitations.

Thanks again!

Xiang

> Gr{oetje,eeting}s,
>
>                         Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
>                                 -- Linus Torvalds
>