Re: [PATCH v6 11/13] can: peak_usb: don't read past the message in PCAN-USB Pro decoders
From: Stéphane Grosjean
Date: Fri Oct 30 2026 - 06:34:10 EST
On 24/10/2026 05:58, netdev-bot+sashiko@xxxxxxxxxx wrote:
[...]
> [Severity: Low]
> With the current callers, is the last sentence accurate? The code change
> looks correct. It is less clear that the old walk could ever leave the
> command buffer allocation.
[...]
> Could the commit message describe this case instead, so that the stated
> impact matches what the old pcan_usb_pro_wait_rsp() code could actually
> do?
Right, the walk can't leave the command buffer with the current
callers. v7 reads:
- pcan_usb_pro_wait_rsp() doesn't check the records against the
received length at all. A truncated response is then accepted, and
pcan_usb_pro_get_can_channel_id() returns stale bytes of its own
request as the channel id. With the current callers, the walk only
stays within the command buffer because its unused tail is zeroed.
Thanks!
Stéphane