[PATCH net] can: peak_usb: validate PCAN-USB Pro receive lengths

[Weiming Shi]

The PCAN-USB Pro decoder validates each receive record using the size
implied by its type, but copies CAN data using a separate device-supplied
DLC.  A zero-data record at the end of the 1024-byte RX buffer can
therefore make memcpy() read up to 15 bytes beyond the kmalloc-1k object
and write seven bytes beyond can_frame::data.

Convert the classic-CAN DLC before use and reject non-RTR records whose
converted length exceeds the payload present in that record type.  Keep
RTR records exempt from the payload check because they legitimately carry
a DLC without data.

KASAN reports:

  memcpy: detected field-spanning write (size 15) of single field "can_frame->data" at drivers/net/can/usb/peak_usb/pcan_usb_pro.c:562 (size 8)
  BUG: KASAN: slab-out-of-bounds in pcan_usb_pro_decode_buf
  Read of size 15 at addr ffff888021468800 by task swapper/0/0
  Call Trace:
   <IRQ>
   kasan_report mm/kasan/report.c:595
   kasan_check_range mm/kasan/generic.c:200
   __asan_memcpy mm/kasan/shadow.c:105
   pcan_usb_pro_decode_buf drivers/net/can/usb/peak_usb/pcan_usb_pro.c:562
   peak_usb_read_bulk_callback drivers/net/can/usb/peak_usb/pcan_usb_core.c:267
   __usb_hcd_giveback_urb drivers/usb/core/hcd.c:1657

  The buggy address is located 0 bytes to the right of
   allocated 1024-byte region [ffff888021468400, ffff888021468800)

Fixes: d8a199355f8f ("can: usb: PEAK-System Technik PCAN-USB Pro specific part")
Reported-by: co+4bda3bf8e1a2b780@xxxxxxx
Closes: https://lore.kernel.org/all/XNNBJQCVSRi1dUNtFoqHoHlP3XDSNifVcPOu%40bugs.sh/
Assisted-by: Claude:gpt-5
Signed-off-by: Weiming Shi <bestswngs@xxxxxxxxx>
---
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index b6be8c19e537f..84ebe2904f6ef 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -531,7 +531,8 @@ struct pcan_usb_pro_interface *pcan_usb_pro_dev_if(struct peak_usb_device *dev)
 }
 
 static int pcan_usb_pro_handle_canmsg(struct pcan_usb_pro_interface *usb_if,
-				      struct pcan_usb_pro_rxmsg *rx)
+				      struct pcan_usb_pro_rxmsg *rx,
+				      u16 sizeof_rec)
 {
 	const unsigned int ctrl_idx = (rx->len >> 4) & 0x0f;
 	struct peak_usb_device *dev;
@@ -551,7 +552,14 @@ static int pcan_usb_pro_handle_canmsg(struct pcan_usb_pro_interface *usb_if,
 		return -ENOMEM;
 
 	can_frame->can_id = le32_to_cpu(rx->id);
-	can_frame->len = rx->len & 0x0f;
+	can_frame_set_cc_len(can_frame, rx->len & 0x0f, dev->can.ctrlmode);
+
+	if (!(rx->flags & PCAN_USBPRO_RTR) &&
+	    sizeof_rec - offsetof(struct pcan_usb_pro_rxmsg, data) <
+	    can_frame->len) {
+		kfree_skb(skb);
+		return -EBADMSG;
+	}
 
 	if (rx->flags & PCAN_USBPRO_EXT)
 		can_frame->can_id |= CAN_EFF_FLAG;
@@ -750,7 +758,8 @@ static int pcan_usb_pro_decode_buf(struct peak_usb_device *dev, struct urb *urb)
 		case PCAN_USBPRO_RXMSG4:
 		case PCAN_USBPRO_RXMSG0:
 		case PCAN_USBPRO_RXRTR:
-			err = pcan_usb_pro_handle_canmsg(usb_if, &pr->rx_msg);
+			err = pcan_usb_pro_handle_canmsg(usb_if, &pr->rx_msg,
+							 sizeof_rec);
 			if (err < 0)
 				goto fail;
 			break;
-- 
2.55.0